Provides an API to Splunks Security Content located at: github.com/splunk/security-content
\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[],"owner":"4046507","collectionId":"7599a47a-6d62-447a-8a21-7582421bdded","publishedId":"UyrDDFiu","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"EF5B25"},"publishDate":"2022-04-26T20:22:43.000Z"},"item":[{"name":"detections","item":[{"name":"/detections","id":"ea1a9786-54a6-4146-9a07-7d724ce9c371","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"GET","header":[],"url":"https://content.splunkresearch.com/detections","description":"list all detections
\n","urlObject":{"path":["detections"],"host":["https://content.splunkresearch.com"],"query":[{"disabled":true,"description":{"content":"Include community contributed content
\n","type":"text/plain"},"key":"","value":""}],"variable":[]}},"response":[{"id":"7ade5e7f-996c-412f-8518-97c0c03d6583","name":"/detections","originalRequest":{"method":"GET","header":[],"url":"https://content.splunkresearch.com/detections"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Date","value":"Thu, 05 Nov 2020 08:05:36 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Content-Length","value":"720907"},{"key":"Connection","value":"keep-alive"},{"key":"x-amzn-RequestId","value":"050270b4-e74b-4ff3-9e92-6c36b3422abe"},{"key":"Access-Control-Allow-Origin","value":"*"},{"key":"Access-Control-Allow-Headers","value":"Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key"},{"key":"x-amz-apigw-id","value":"VhjKfHxtvHcFtXg="},{"key":"X-Amzn-Trace-Id","value":"Root=1-5fa3b243-61b324b349012a7a0f1035ac;Sampled=0"}],"cookie":[],"responseTime":null,"body":"{\n \"detections\": [\n {\n \"name\": \"Detect New Login Attempts to Routers\",\n \"id\": \"104658f4-afdc-499e-9719-17243rr826f1\",\n \"version\": 1,\n \"date\": \"2017-09-12\",\n \"description\": \"The search queries the authentication logs for assets that are categorized as routers in the ES Assets and Identity Framework, to identify connections that have not been seen before in the last 30 days.\",\n \"how_to_implement\": \"To successfully implement this search, you must ensure the network router devices are categorized as \\\"router\\\" in the Assets and identity table. You must also populate the Authentication data model with logs related to users authenticating to routing infrastructure.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count earliest(_time) as earliest latest(_time) as latest from datamodel=Authentication where Authentication.dest_category=router by Authentication.dest Authentication.user| eval isOutlier=if(earliest >= relative_time(now(), \\\"-30d@d\\\"), 1, 0) | where isOutlier=1| `security_content_ctime(earliest)`| `security_content_ctime(latest)` | `drop_dm_object_name(\\\"Authentication\\\")` | `detect_new_login_attempts_to_routers_filter`\",\n \"known_false_positives\": \"Legitimate router connections may appear as new connections\",\n \"tags\": {\n \"analytics_story\": [\n \"Router and Infrastructure Security\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 11\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"PR.AC\",\n \"PR.IP\"\n ],\n \"security_domain\": \"network\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"detect_new_login_attempts_to_routers_filter\"\n }\n ]\n },\n {\n \"name\": \"Phishing Email Detection by Machine Learning Method - SSA\",\n \"id\": \"4b237388-dfa1-41a6-91d4-4de2d598376f\",\n \"version\": 1,\n \"date\": \"2020-08-25\",\n \"description\": \"Malicious mails can conduct phishing that induces readers to open attachment, click links or trigger third party service. This detect uses Natural Language Processing (NLP) approach to analyze an email message's content (Sender, Subject and Body) and judge whether it is a phishing email. The detection adopts a deep learning (neural network) model that employs character level embeddings plus LSTM layers to perform classification. The model is pre-trained and then published as ONNX format. Current sample model is trained using the dataset published at https://github.com/splunk/attack_data/tree/master/datasets/T1566_Phishing_Email/splunk_train.json User are expected to re-train the model by combining with their own training data for better accuracy using the provided model file (SMLE notebook). DSP pipeline then processes the email message and passes it as an event to Apply ML Models function, which returns the probability of a phishing email. Current implementation assumes the email is fed to DSP in JSON format contains at least email's sender, subject and its message body, including reply content, if any.\",\n \"how_to_implement\": \"Events are fed to DSP contains at least email's sender, subject and its message body.\",\n \"references\": [],\n \"type\": \"SSA\",\n \"author\": \"Xiao Lin, Splunk\",\n \"search\": \"| from read_ssa_enriched_events() | where source_type=\\\"email\\\" | eval strJsn=cast(body, \\\"string\\\"), jsonMap=from_json_object(strJsn), eventLine=concat(ucast(map_get(jsonMap, \\\"From\\\"), \\\"string\\\", \\\" \\\"), \\\" \\\", ucast(map_get(jsonMap, \\\"Subject\\\"), \\\"string\\\", \\\" \\\"), \\\" \\\", ucast(map_get(jsonMap, \\\"Content\\\"), \\\"string\\\", \\\" \\\"), \\\" \\\"), Date=ucast(map_get(jsonMap, \\\"Date\\\"), \\\"string\\\", \\\" NA\\\") | where eventLine IS NOT NULL | eval mapC={\\\" \\\": 32, \\\"!\\\": 33, \\\"\\\\\\\"\\\": 34, \\\"#\\\": 35, \\\"$\\\": 36, \\\"%\\\": 37, \\\"&\\\": 38, \\\"`\\\": 39, \\\"(\\\": 40, \\\")\\\": 41, \\\"*\\\": 42, \\\"+\\\": 43, \\\",\\\": 44, \\\"-\\\": 45, \\\".\\\": 46, \\\"/\\\": 47, \\\"0\\\": 48, \\\"1\\\": 49, \\\"2\\\": 50, \\\"3\\\": 51, \\\"4\\\": 52, \\\"5\\\": 53, \\\"6\\\": 54, \\\"7\\\": 55, \\\"8\\\": 56, \\\"9\\\": 57, \\\":\\\": 58, \\\";\\\": 59, \\\"<\\\": 60, \\\"=\\\": 61, \\\">\\\": 62, \\\"?\\\": 63, \\\"@\\\": 64, \\\"A\\\": 65, \\\"B\\\": 66, \\\"C\\\": 67, \\\"D\\\": 68, \\\"E\\\": 69, \\\"F\\\": 70, \\\"G\\\": 71, \\\"H\\\": 72, \\\"I\\\": 73, \\\"J\\\": 74, \\\"K\\\": 75, \\\"L\\\": 76, \\\"M\\\": 77, \\\"N\\\": 78, \\\"O\\\": 79, \\\"P\\\": 80, \\\"Q\\\": 81, \\\"R\\\": 82, \\\"S\\\": 83, \\\"T\\\": 84, \\\"U\\\": 85, \\\"V\\\": 86, \\\"W\\\": 87, \\\"X\\\": 88, \\\"Y\\\": 89, \\\"Z\\\": 90, \\\"[\\\": 91, \\\"\\\\\\\\\\\": 92, \\\"]\\\": 93, \\\"^\\\": 94, \\\"_\\\": 95, \\\"`\\\": 96, \\\"a\\\": 97, \\\"b\\\": 98, \\\"c\\\": 99, \\\"d\\\": 100, \\\"e\\\": 101, \\\"f\\\": 102, \\\"g\\\": 103, \\\"h\\\": 104, \\\"i\\\": 105, \\\"j\\\": 106, \\\"k\\\": 107, \\\"l\\\": 108, \\\"m\\\": 109, \\\"n\\\": 110, \\\"o\\\": 111, \\\"p\\\": 112, \\\"q\\\": 113, \\\"r\\\": 114, \\\"s\\\": 115, \\\"t\\\": 116, \\\"u\\\": 117, \\\"v\\\": 118, \\\"w\\\": 119, \\\"x\\\": 120, \\\"y\\\": 121, \\\"z\\\": 122, \\\"{\\\": 123, \\\"|\\\": 124, \\\"}\\\": 125, \\\"~\\\": 126}, `embedding_input:0` = for_each(iterator(mvrange(1,129), \\\"i\\\"), cast(map_get(mapC, substr(eventLine, i, 1)), \\\"float\\\") ) | apply_model connection_id=\\\"YOUR_S3_ONNX_CONNECTOR_ID\\\" name=\\\"phishing_email_v7\\\" path=\\\"s3://smle-experiments/models/phishing_email\\\" | eval probability = mvindex(`dense/Sigmoid:0`, 0) | where probability > 0.5 | eval start_time=Date, end_time=Date, entities=\\\"TBD\\\", body=\\\"TBD\\\" | select probability, body, entities, start_time, end_time | into write_ssa_detected_events();\",\n \"known_false_positives\": \"Because of imbalance of anomaly data in training, the model will less likely report false positive. Instead, the model is more prone to false negative. Current best recall score is ~85%\",\n \"tags\": {\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"mitre_technique_id\": [\n \"T1566\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\"\n ],\n \"risk_severity\": \"low\",\n \"security_domain\": \"mail server\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n }\n },\n {\n \"name\": \"Email Attachments With Lots Of Spaces\",\n \"id\": \"56e877a6-1455-4479-ada6-0550dc1e22f8\",\n \"version\": 2,\n \"date\": \"2017-09-19\",\n \"description\": \"Attackers often use spaces as a means to obfuscate an attachment's file extension. This search looks for messages with email attachments that have many spaces within the file names.\",\n \"how_to_implement\": \"You need to ingest data from emails. Specifically, the sender's address and the file names of any attachments must be mapped to the Email data model. The threshold ratio is set to 10%, but this value can be configured to suit each environment. \\\\\\n **Splunk Phantom Playbook Integration**\\\\\\nIf Splunk Phantom is also configured in your environment, a playbook called \\\"Suspicious Email Attachment Investigate and Delete\\\" can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname to the \\\"Phantom Instance\\\" field in the Adaptive Response Actions when configuring this detection search. The notable event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox.\",\n \"type\": \"ESCU\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(All_Email.recipient) as recipient_address min(_time) as firstTime max(_time) as lastTime from datamodel=Email where All_Email.file_name=\\\"*\\\" by All_Email.src_user, All_Email.file_name All_Email.message_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(\\\"All_Email\\\")` | eval space_ratio = (mvcount(split(file_name,\\\" \\\"))-1)/len(file_name) | search space_ratio >= 0.1 | rex field=recipient_address \\\"(?Add Prohibited Processes to Enterprise Security.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `prohibited_softwares` | `prohibited_software_on_endpoint_filter`\",\n \"known_false_positives\": \"None identified\",\n \"tags\": {\n \"analytics_story\": [\n \"Monitor for Unauthorized Software\",\n \"Emotet Malware DHS Report TA18-201A \",\n \"SamSam Ransomware\"\n ],\n \"kill_chain_phases\": [\n \"Installation\",\n \"Command and Control\",\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 2\"\n ],\n \"nist\": [\n \"ID.AM\",\n \"PR.DS\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"baselines\": [\n {\n \"name\": \"Add Prohibited Processes to Enterprise Security\",\n \"id\": \"251930a5-1451-4428-bb13-eed5775be0ce\",\n \"version\": 1,\n \"date\": \"2017-09-15\",\n \"description\": \"This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints.\",\n \"how_to_implement\": \"This search should be run on each new install of ESCU.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| inputlookup interesting_processes_lookup | search note!=ESCU* | inputlookup append=T prohibitedProcesses_lookup | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup interesting_processes_lookup | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"Emotet Malware DHS Report TA18-201A \",\n \"Monitor for Unauthorized Software\",\n \"SamSam Ransomware\"\n ],\n \"detections\": [\n \"Prohibited Software On Endpoint\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"lookup interesting_processes_lookup app as process_name OUTPUT is_prohibited | search is_prohibited=True\",\n \"description\": \"This macro limits the output to process_names that have been marked as prohibited\",\n \"name\": \"prohibited_softwares\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"prohibited_software_on_endpoint_filter\"\n }\n ]\n },\n {\n \"name\": \"Reg exe Manipulating Windows Services Registry Keys\",\n \"id\": \"8470d755-0c13-45b3-bd63-387a373c10cf\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"The search looks for reg.exe modifying registry keys that define Windows services and their configurations.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services* by Processes.process_id Processes.dest Processes.process | `drop_dm_object_name(\\\"Processes\\\")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `reg_exe_manipulating_windows_services_registry_keys_filter`\",\n \"known_false_positives\": \"It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate.\",\n \"tags\": {\n \"analytics_story\": [\n \"Windows Service Abuse\",\n \"Windows Persistence Techniques\"\n ],\n \"mitre_attack_id\": [\n \"T1547.001\"\n ],\n \"kill_chain_phases\": [\n \"Installation\"\n ],\n \"cis20\": [\n \"CIS 3\",\n \"CIS 5\",\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.IP\",\n \"PR.PT\",\n \"PR.AC\",\n \"PR.AT\",\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Registry Run Keys / Startup Folder\"\n ],\n \"mitre_attack_tactics\": [\n \"Persistence\",\n \"Privilege Escalation\"\n ],\n \"mitre_attack_groups\": [\n \"Rocke\",\n \"Tropic Trooper\",\n \"Gamaredon Group\",\n \"Sharpshooter\",\n \"Molerats\",\n \"Silence\",\n \"RTM\",\n \"Inception\",\n \"APT41\",\n \"Machete\",\n \"Kimsuky\",\n \"APT33\",\n \"APT39\",\n \"APT32\",\n \"APT18\",\n \"Turla\",\n \"Dark Caracal\",\n \"Cobalt Group\",\n \"Honeybee\",\n \"Threat Group-3390\",\n \"Dragonfly 2.0\",\n \"Gorgon Group\",\n \"Ke3chang\",\n \"APT19\",\n \"Leviathan\",\n \"MuddyWater\",\n \"APT37\",\n \"BRONZE BUTLER\",\n \"Magic Hound\",\n \"APT3\",\n \"FIN10\",\n \"FIN7\",\n \"Patchwork\",\n \"FIN6\",\n \"Lazarus Group\",\n \"Putter Panda\",\n \"APT29\",\n \"Darkhotel\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"reg_exe_manipulating_windows_services_registry_keys_filter\"\n }\n ]\n },\n {\n \"name\": \"Reg exe used to hide files directories via registry keys\",\n \"id\": \"c77162d3-f93c-45cc-80c8-22f6b5264x9f\",\n \"version\": 2,\n \"date\": \"2019-02-27\",\n \"description\": \"The search looks for command-line arguments used to hide a file or directory using the reg add command.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = reg.exe Processes.process=\\\"*add*\\\" Processes.process=\\\"*Hidden*\\\" Processes.process=\\\"*REG_DWORD*\\\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`| regex process = \\\"(/d\\\\s+2)\\\" | `reg_exe_used_to_hide_files_directories_via_registry_keys_filter`\",\n \"known_false_positives\": \"None at the moment\",\n \"tags\": {\n \"analytics_story\": [\n \"Windows Defense Evasion Tactics\",\n \"Suspicious Windows Registry Activities\",\n \"Windows Persistence Techniques\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"reg_exe_used_to_hide_files_directories_via_registry_keys_filter\"\n }\n ]\n },\n {\n \"name\": \"Registry Keys for Creating SHIM Databases\",\n \"id\": \"f5f6af30-7aa7-4295-bfe9-07fe87c01bbb\",\n \"version\": 2,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes.\",\n \"how_to_implement\": \"To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response products, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry AND (All_Changes.object_path=\\\"*CurrentVersion\\\\\\\\AppCompatFlags\\\\\\\\Custom*\\\" OR All_Changes.object_path=\\\"*CurrentVersion\\\\\\\\AppCompatFlags\\\\\\\\InstalledSDB*\\\") by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object, All_Changes.object_path | `drop_dm_object_name(\\\"All_Changes\\\")` | `registry_keys_for_creating_shim_databases_filter`\",\n \"known_false_positives\": \"There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications\",\n \"tags\": {\n \"analytics_story\": [\n \"Suspicious Windows Registry Activities\",\n \"Windows Persistence Techniques\"\n ],\n \"mitre_attack_id\": [\n \"T1546.011\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Application Shimming\"\n ],\n \"mitre_attack_tactics\": [\n \"Privilege Escalation\",\n \"Persistence\"\n ],\n \"mitre_attack_groups\": [\n \"FIN7\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"registry_keys_for_creating_shim_databases_filter\"\n }\n ]\n },\n {\n \"name\": \"Registry Keys Used For Persistence\",\n \"id\": \"f5f6af30-7aa7-4295-bfe9-07fe87c01a4b\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"The search looks for modifications to registry keys that can be used to launch an application or service at system startup.\",\n \"how_to_implement\": \"To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\\\\\\\run* OR Registry.registry_path=*currentVersion\\\\\\\\Windows\\\\\\\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\\\\\\\Winlogon\\\\\\\\Shell* OR Registry.registry_path=*CurrentVersion\\\\\\\\Winlogon\\\\\\\\Userinit* OR Registry.registry_path=*CurrentVersion\\\\\\\\Winlogon\\\\\\\\VmApplet* OR Registry.registry_path=*currentversion\\\\\\\\policies\\\\\\\\explorer\\\\\\\\run* OR Registry.registry_path=*currentversion\\\\\\\\runservices* OR Registry.registry_path=*\\\\\\\\CurrentControlSet\\\\\\\\Control\\\\\\\\Lsa\\\\\\\\* OR Registry.registry_path=\\\"*Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\Image File Execution Options*\\\" OR Registry.registry_path=HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Netsh\\\\\\\\*) by Registry.dest , Registry.status, Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`\",\n \"known_false_positives\": \"There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task.\",\n \"tags\": {\n \"analytics_story\": [\n \"Suspicious Windows Registry Activities\",\n \"Suspicious MSHTA Activity\",\n \"DHS Report TA18-074A\",\n \"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns\",\n \"Ransomware\",\n \"Windows Persistence Techniques\",\n \"Emotet Malware DHS Report TA18-201A \"\n ],\n \"mitre_attack_id\": [\n \"T1547.001\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\",\n \"DE.AE\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Registry Run Keys / Startup Folder\"\n ],\n \"mitre_attack_tactics\": [\n \"Persistence\",\n \"Privilege Escalation\"\n ],\n \"mitre_attack_groups\": [\n \"Rocke\",\n \"Tropic Trooper\",\n \"Gamaredon Group\",\n \"Sharpshooter\",\n \"Molerats\",\n \"Silence\",\n \"RTM\",\n \"Inception\",\n \"APT41\",\n \"Machete\",\n \"Kimsuky\",\n \"APT33\",\n \"APT39\",\n \"APT32\",\n \"APT18\",\n \"Turla\",\n \"Dark Caracal\",\n \"Cobalt Group\",\n \"Honeybee\",\n \"Threat Group-3390\",\n \"Dragonfly 2.0\",\n \"Gorgon Group\",\n \"Ke3chang\",\n \"APT19\",\n \"Leviathan\",\n \"MuddyWater\",\n \"APT37\",\n \"BRONZE BUTLER\",\n \"Magic Hound\",\n \"APT3\",\n \"FIN10\",\n \"FIN7\",\n \"Patchwork\",\n \"FIN6\",\n \"Lazarus Group\",\n \"Putter Panda\",\n \"APT29\",\n \"Darkhotel\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"registry_keys_used_for_persistence_filter\"\n }\n ]\n },\n {\n \"name\": \"Registry Keys Used For Privilege Escalation\",\n \"id\": \"c9f4b923-f8af-4155-b697-1354f5bcbc5e\",\n \"version\": 3,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under \\\"Image File Execution Options\\\" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries.\",\n \"how_to_implement\": \"To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.\",\n \"type\": \"ESCU\",\n \"references\": [\n \"https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/\"\n ],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=\\\"*Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\Image File Execution Options*\\\") AND (Registry.registry_key_name=GlobalFlag OR Registry.registry_key_name=Debugger) by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_privilege_escalation_filter`\",\n \"known_false_positives\": \"There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task.\",\n \"tags\": {\n \"analytics_story\": [\n \"Windows Privilege Escalation\",\n \"Suspicious Windows Registry Activities\"\n ],\n \"mitre_attack_id\": [\n \"T1547.001\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Registry Run Keys / Startup Folder\"\n ],\n \"mitre_attack_tactics\": [\n \"Persistence\",\n \"Privilege Escalation\"\n ],\n \"mitre_attack_groups\": [\n \"Rocke\",\n \"Tropic Trooper\",\n \"Gamaredon Group\",\n \"Sharpshooter\",\n \"Molerats\",\n \"Silence\",\n \"RTM\",\n \"Inception\",\n \"APT41\",\n \"Machete\",\n \"Kimsuky\",\n \"APT33\",\n \"APT39\",\n \"APT32\",\n \"APT18\",\n \"Turla\",\n \"Dark Caracal\",\n \"Cobalt Group\",\n \"Honeybee\",\n \"Threat Group-3390\",\n \"Dragonfly 2.0\",\n \"Gorgon Group\",\n \"Ke3chang\",\n \"APT19\",\n \"Leviathan\",\n \"MuddyWater\",\n \"APT37\",\n \"BRONZE BUTLER\",\n \"Magic Hound\",\n \"APT3\",\n \"FIN10\",\n \"FIN7\",\n \"Patchwork\",\n \"FIN6\",\n \"Lazarus Group\",\n \"Putter Panda\",\n \"APT29\",\n \"Darkhotel\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"registry_keys_used_for_privilege_escalation_filter\"\n }\n ]\n },\n {\n \"name\": \"Remote Desktop Process Running On System\",\n \"id\": \"f5939373-8054-40ad-8c64-cec478a22a4a\",\n \"version\": 5,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for the remote desktop process mstsc.exe running on systems upon which it doesn't typically run. This is accomplished by filtering out all systems that are noted in the `common_rdp_source category` in the Assets and Identity framework.\",\n \"how_to_implement\": \"To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. The search requires you to identify systems that do not commonly use remote desktop. You can use the included support search \\\"Identify Systems Using Remote Desktop\\\" to identify these systems. After identifying them, you will need to add the \\\"common_rdp_source\\\" category to that system using the Enterprise Security Assets and Identities framework. This can be done by adding an entry in the assets.csv file located in `SA-IdentityManagement/lookups`.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*mstsc.exe AND Processes.dest_category!=common_rdp_source by Processes.dest Processes.user Processes.process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `remote_desktop_process_running_on_system_filter` \",\n \"known_false_positives\": \"Remote Desktop may be used legitimately by users on the network.\",\n \"tags\": {\n \"analytics_story\": [\n \"Hidden Cobra Malware\",\n \"Lateral Movement\"\n ],\n \"mitre_attack_id\": [\n \"T1021.001\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 3\",\n \"CIS 9\",\n \"CIS 16\"\n ],\n \"nist\": [\n \"DE.AE\",\n \"PR.AC\",\n \"PR.IP\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Remote Desktop Protocol\"\n ],\n \"mitre_attack_tactics\": [\n \"Lateral Movement\"\n ],\n \"mitre_attack_groups\": [\n \"Blue Mockingbird\",\n \"Wizard Spider\",\n \"Silence\",\n \"APT41\",\n \"TEMP.Veles\",\n \"Leviathan\",\n \"APT39\",\n \"Stolen Pencil\",\n \"Cobalt Group\",\n \"Dragonfly 2.0\",\n \"FIN8\",\n \"APT3\",\n \"OilRig\",\n \"menuPass\",\n \"FIN10\",\n \"Patchwork\",\n \"FIN6\",\n \"Lazarus Group\",\n \"APT1\",\n \"Axiom\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"remote_desktop_process_running_on_system_filter\"\n }\n ]\n },\n {\n \"name\": \"Remote Process Instantiation via WMI\",\n \"id\": \"d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for wmic.exe being launched with parameters to spawn a process on a remote system.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = wmic.exe Processes.process=\\\"*/node*\\\" Processes.process=\\\"*process*\\\" Processes.process=\\\"*call*\\\" Processes.process=\\\"*create*\\\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`\",\n \"known_false_positives\": \"The wmic.exe utility is a benign Windows application. It may be used legitimately by Administrators with these parameters for remote system administration, but it's relatively uncommon.\",\n \"tags\": {\n \"analytics_story\": [\n \"Ransomware\",\n \"Suspicious WMI Use\"\n ],\n \"mitre_attack_id\": [\n \"T1021.001\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 3\",\n \"CIS 5\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"PR.AT\",\n \"PR.AC\",\n \"PR.IP\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Remote Desktop Protocol\"\n ],\n \"mitre_attack_tactics\": [\n \"Lateral Movement\"\n ],\n \"mitre_attack_groups\": [\n \"Blue Mockingbird\",\n \"Wizard Spider\",\n \"Silence\",\n \"APT41\",\n \"TEMP.Veles\",\n \"Leviathan\",\n \"APT39\",\n \"Stolen Pencil\",\n \"Cobalt Group\",\n \"Dragonfly 2.0\",\n \"FIN8\",\n \"APT3\",\n \"OilRig\",\n \"menuPass\",\n \"FIN10\",\n \"Patchwork\",\n \"FIN6\",\n \"Lazarus Group\",\n \"APT1\",\n \"Axiom\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"remote_process_instantiation_via_wmi_filter\"\n }\n ]\n },\n {\n \"name\": \"Remote Registry Key modifications\",\n \"id\": \"c9f4b923-f8af-4155-b697-1354f5dcbc5e\",\n \"version\": 3,\n \"date\": \"2020-03-02\",\n \"description\": \"This search monitors for remote modifications to registry keys.\",\n \"how_to_implement\": \"To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=\\\"\\\\\\\\\\\\\\\\*\\\" by Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `remote_registry_key_modifications_filter`\",\n \"known_false_positives\": \"This technique may be legitimately used by administrators to modify remote registries, so it's important to filter these events out.\",\n \"tags\": {\n \"analytics_story\": [\n \"Windows Defense Evasion Tactics\",\n \"Suspicious Windows Registry Activities\",\n \"Windows Persistence Techniques\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"remote_registry_key_modifications_filter\"\n }\n ]\n },\n {\n \"name\": \"Remote WMI Command Attempt\",\n \"id\": \"272df6de-61f1-4784-877c-1fbc3e2d0838\",\n \"version\": 2,\n \"date\": \"2018-12-03\",\n \"description\": \"This search looks for wmic.exe being launched with parameters to operate on remote systems.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe AND Processes.process= */node* by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`\",\n \"known_false_positives\": \"Administrators may use this legitimately to gather info from remote systems.\",\n \"tags\": {\n \"analytics_story\": [\n \"Suspicious WMI Use\"\n ],\n \"mitre_attack_id\": [\n \"T1047\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 3\",\n \"CIS 5\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"PR.AT\",\n \"PR.AC\",\n \"PR.IP\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Windows Management Instrumentation\"\n ],\n \"mitre_attack_tactics\": [\n \"Execution\"\n ],\n \"mitre_attack_groups\": [\n \"Blue Mockingbird\",\n \"Wizard Spider\",\n \"Frankenstein\",\n \"APT41\",\n \"FIN6\",\n \"Soft Cell\",\n \"APT32\",\n \"MuddyWater\",\n \"OilRig\",\n \"Threat Group-3390\",\n \"FIN8\",\n \"Leviathan\",\n \"menuPass\",\n \"Stealth Falcon\",\n \"Lazarus Group\",\n \"APT29\",\n \"Deep Panda\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"remote_wmi_command_attempt_filter\"\n }\n ]\n },\n {\n \"name\": \"RunDLL Loading DLL By Ordinal\",\n \"id\": \"6c135f8d-5e60-454e-80b7-c56eed739833\",\n \"version\": 3,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for DLLs under %AppData% being loaded by rundll32.exe that are calling the exported function at ordinal 2. Calling exported functions by ordinal is not as common as calling by exported name. There was a bug fixed in IDAPro on 2016-08-08 that would not display functions without names. Calling functions by ordinal would overcome the lack of name and make it harder for analyst to reverse engineer.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = rundll32.exe Processes.process=\\\"*AppData*\\\" Processes.process=\\\"*,#2\\\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll_loading_dll_by_ordinal_filter`\",\n \"known_false_positives\": \"While not common, loading a DLL under %AppData% and calling a function by ordinal is possible by a legitimate process\",\n \"tags\": {\n \"analytics_story\": [\n \"Unusual Processes\"\n ],\n \"mitre_attack_id\": [\n \"T1218.011\"\n ],\n \"kill_chain_phases\": [\n \"Installation\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Rundll32\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\"\n ],\n \"mitre_attack_groups\": [\n \"APT32\",\n \"Sandworm Team\",\n \"Blue Mockingbird\",\n \"TA505\",\n \"MuddyWater\",\n \"APT29\",\n \"APT19\",\n \"CopyKittens\",\n \"APT3\",\n \"Carbanak\",\n \"APT28\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"rundll_loading_dll_by_ordinal_filter\"\n }\n ]\n },\n {\n \"name\": \"Samsam Test File Write\",\n \"id\": \"69c12d59-d951-431e-ab77-ec426b8d65e6\",\n \"version\": 1,\n \"date\": \"2018-12-14\",\n \"description\": \"The search looks for a file named \\\"test.txt\\\" written to the windows system directory tree, which is consistent with Samsam propagation.\",\n \"how_to_implement\": \"You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name from datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\\\\\\\windows\\\\\\\\system32\\\\\\\\test.txt by Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `samsam_test_file_write_filter`\",\n \"known_false_positives\": \"No false positives have been identified.\",\n \"tags\": {\n \"analytics_story\": [\n \"SamSam Ransomware\"\n ],\n \"kill_chain_phases\": [\n \"Delivery\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"samsam_test_file_write_filter\"\n }\n ]\n },\n {\n \"name\": \"Sc exe Manipulating Windows Services\",\n \"id\": \"f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for arguments to sc.exe indicating the creation or modification of a Windows service.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe (Processes.process=\\\"* create *\\\" OR Processes.process=\\\"* config *\\\") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sc_exe_manipulating_windows_services_filter`\",\n \"known_false_positives\": \"Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate.\",\n \"tags\": {\n \"analytics_story\": [\n \"Windows Service Abuse\",\n \"DHS Report TA18-074A\",\n \"Orangeworm Attack Group\",\n \"Windows Persistence Techniques\",\n \"Disabling Security Tools\"\n ],\n \"mitre_attack_id\": [\n \"T1543.003\"\n ],\n \"kill_chain_phases\": [\n \"Installation\"\n ],\n \"cis20\": [\n \"CIS 3\",\n \"CIS 5\",\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.IP\",\n \"PR.PT\",\n \"PR.AC\",\n \"PR.AT\",\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Windows Service\"\n ],\n \"mitre_attack_tactics\": [\n \"Persistence\",\n \"Privilege Escalation\"\n ],\n \"mitre_attack_groups\": [\n \"Blue Mockingbird\",\n \"DarkVishnya\",\n \"Wizard Spider\",\n \"APT32\",\n \"APT41\",\n \"Kimsuky\",\n \"Tropic Trooper\",\n \"Cobalt Group\",\n \"Ke3chang\",\n \"Honeybee\",\n \"FIN7\",\n \"Threat Group-3390\",\n \"APT19\",\n \"APT3\",\n \"Lazarus Group\",\n \"Carbanak\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"sc_exe_manipulating_windows_services_filter\"\n }\n ]\n },\n {\n \"name\": \"Scheduled Task Name Used by Dragonfly Threat Actors\",\n \"id\": \"d5af132c-7c17-439c-9d31-13d55340f36c\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for flags passed to schtasks.exe on the command-line that indicate a task name associated with the Dragonfly threat actor was created or deleted.\",\n \"how_to_implement\": \"You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search (process=*delete* OR process=*create*) process=*reset* | `scheduled_task_name_used_by_dragonfly_threat_actors_filter` \",\n \"known_false_positives\": \"No known false positives\",\n \"tags\": {\n \"analytics_story\": [\n \"DHS Report TA18-074A\"\n ],\n \"mitre_attack_id\": [\n \"T1053.005\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 3\"\n ],\n \"nist\": [\n \"PR.IP\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Scheduled Task\"\n ],\n \"mitre_attack_tactics\": [\n \"Execution\",\n \"Persistence\",\n \"Privilege Escalation\"\n ],\n \"mitre_attack_groups\": [\n \"Gamaredon Group\",\n \"Blue Mockingbird\",\n \"MuddyWater\",\n \"Wizard Spider\",\n \"Frankenstein\",\n \"APT-C-36\",\n \"BRONZE BUTLER\",\n \"APT41\",\n \"Machete\",\n \"Soft Cell\",\n \"Silence\",\n \"TEMP.Veles\",\n \"APT33\",\n \"APT39\",\n \"Dragonfly 2.0\",\n \"Patchwork\",\n \"OilRig\",\n \"Rancor\",\n \"Cobalt Group\",\n \"FIN8\",\n \"menuPass\",\n \"FIN10\",\n \"APT32\",\n \"FIN7\",\n \"Stealth Falcon\",\n \"FIN6\",\n \"APT3\",\n \"APT29\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"scheduled_task_name_used_by_dragonfly_threat_actors_filter\"\n }\n ]\n },\n {\n \"name\": \"Scheduled tasks used in BadRabbit ransomware\",\n \"id\": \"1297fb80-f42a-4b4a-9c8b-78c066437cf6\",\n \"version\": 3,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process= \\\"*create*\\\" OR Processes.process= \\\"*delete*\\\") by Processes.parent_process Processes.process_name Processes.user | `drop_dm_object_name(\\\"Processes\\\")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | search (process=*rhaegal* OR process=*drogon* OR *viserion_*) | `scheduled_tasks_used_in_badrabbit_ransomware_filter`\",\n \"known_false_positives\": \"No known false positives\",\n \"tags\": {\n \"analytics_story\": [\n \"Ransomware\"\n ],\n \"mitre_attack_id\": [\n \"T1053.005\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 3\"\n ],\n \"nist\": [\n \"PR.IP\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Scheduled Task\"\n ],\n \"mitre_attack_tactics\": [\n \"Execution\",\n \"Persistence\",\n \"Privilege Escalation\"\n ],\n \"mitre_attack_groups\": [\n \"Gamaredon Group\",\n \"Blue Mockingbird\",\n \"MuddyWater\",\n \"Wizard Spider\",\n \"Frankenstein\",\n \"APT-C-36\",\n \"BRONZE BUTLER\",\n \"APT41\",\n \"Machete\",\n \"Soft Cell\",\n \"Silence\",\n \"TEMP.Veles\",\n \"APT33\",\n \"APT39\",\n \"Dragonfly 2.0\",\n \"Patchwork\",\n \"OilRig\",\n \"Rancor\",\n \"Cobalt Group\",\n \"FIN8\",\n \"menuPass\",\n \"FIN10\",\n \"APT32\",\n \"FIN7\",\n \"Stealth Falcon\",\n \"FIN6\",\n \"APT3\",\n \"APT29\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"scheduled_tasks_used_in_badrabbit_ransomware_filter\"\n }\n ]\n },\n {\n \"name\": \"Schtasks scheduling job on remote system\",\n \"id\": \"1297fb80-f42a-4b4a-9c8a-88c066237cf6\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for flags passed to schtasks.exe on the command-line that indicate a job is being scheduled on a remote system.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe Processes.process=\\\"*/create*\\\" Processes.process=\\\"* /s *\\\" by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`\",\n \"known_false_positives\": \"Administrators may create jobs on remote systems, but this activity is usually limited to a small set of hosts or users. It is important to validate and investigate as appropriate.\",\n \"tags\": {\n \"analytics_story\": [\n \"Lateral Movement\"\n ],\n \"mitre_attack_id\": [\n \"T1053.005\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 3\"\n ],\n \"nist\": [\n \"PR.IP\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Scheduled Task\"\n ],\n \"mitre_attack_tactics\": [\n \"Execution\",\n \"Persistence\",\n \"Privilege Escalation\"\n ],\n \"mitre_attack_groups\": [\n \"Gamaredon Group\",\n \"Blue Mockingbird\",\n \"MuddyWater\",\n \"Wizard Spider\",\n \"Frankenstein\",\n \"APT-C-36\",\n \"BRONZE BUTLER\",\n \"APT41\",\n \"Machete\",\n \"Soft Cell\",\n \"Silence\",\n \"TEMP.Veles\",\n \"APT33\",\n \"APT39\",\n \"Dragonfly 2.0\",\n \"Patchwork\",\n \"OilRig\",\n \"Rancor\",\n \"Cobalt Group\",\n \"FIN8\",\n \"menuPass\",\n \"FIN10\",\n \"APT32\",\n \"FIN7\",\n \"Stealth Falcon\",\n \"FIN6\",\n \"APT3\",\n \"APT29\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"schtasks_scheduling_job_on_remote_system_filter\"\n }\n ]\n },\n {\n \"name\": \"Schtasks used for forcing a reboot\",\n \"id\": \"1297fb80-f42a-4b4a-9c8a-88c066437cf6\",\n \"version\": 3,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for flags passed to schtasks.exe on the command-line that indicate that a forced reboot of system is scheduled.\",\n \"how_to_implement\": \"To successfully implement this search you need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe Processes.process=\\\"*shutdown*\\\" Processes.process=\\\"*/r*\\\" Processes.process=\\\"*/f*\\\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_used_for_forcing_a_reboot_filter`\",\n \"known_false_positives\": \"Administrators may create jobs on systems forcing reboots to perform updates, maintenance, etc.\",\n \"tags\": {\n \"analytics_story\": [\n \"Windows Persistence Techniques\",\n \"Ransomware\"\n ],\n \"mitre_attack_id\": [\n \"T1053.005\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 3\"\n ],\n \"nist\": [\n \"PR.IP\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Scheduled Task\"\n ],\n \"mitre_attack_tactics\": [\n \"Execution\",\n \"Persistence\",\n \"Privilege Escalation\"\n ],\n \"mitre_attack_groups\": [\n \"Gamaredon Group\",\n \"Blue Mockingbird\",\n \"MuddyWater\",\n \"Wizard Spider\",\n \"Frankenstein\",\n \"APT-C-36\",\n \"BRONZE BUTLER\",\n \"APT41\",\n \"Machete\",\n \"Soft Cell\",\n \"Silence\",\n \"TEMP.Veles\",\n \"APT33\",\n \"APT39\",\n \"Dragonfly 2.0\",\n \"Patchwork\",\n \"OilRig\",\n \"Rancor\",\n \"Cobalt Group\",\n \"FIN8\",\n \"menuPass\",\n \"FIN10\",\n \"APT32\",\n \"FIN7\",\n \"Stealth Falcon\",\n \"FIN6\",\n \"APT3\",\n \"APT29\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"schtasks_used_for_forcing_a_reboot_filter\"\n }\n ]\n },\n {\n \"name\": \"Script Execution via WMI\",\n \"id\": \"aa73f80d-d728-4077-b226-81ea0c8be589\",\n \"version\": 3,\n \"date\": \"2020-03-16\",\n \"description\": \"This search looks for scripts launched via WMI.\",\n \"how_to_implement\": \"You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name = \\\"scrcons.exe\\\" by Processes.user Processes.dest Processes.process_name | `drop_dm_object_name(\\\"Processes\\\")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `script_execution_via_wmi_filter` \",\n \"known_false_positives\": \"Although unlikely, administrators may use wmi to launch scripts for legitimate purposes.\",\n \"tags\": {\n \"analytics_story\": [\n \"Suspicious WMI Use\"\n ],\n \"mitre_attack_id\": [\n \"T1047\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 3\",\n \"CIS 5\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"PR.AT\",\n \"PR.AC\",\n \"PR.IP\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Windows Management Instrumentation\"\n ],\n \"mitre_attack_tactics\": [\n \"Execution\"\n ],\n \"mitre_attack_groups\": [\n \"Blue Mockingbird\",\n \"Wizard Spider\",\n \"Frankenstein\",\n \"APT41\",\n \"FIN6\",\n \"Soft Cell\",\n \"APT32\",\n \"MuddyWater\",\n \"OilRig\",\n \"Threat Group-3390\",\n \"FIN8\",\n \"Leviathan\",\n \"menuPass\",\n \"Stealth Falcon\",\n \"Lazarus Group\",\n \"APT29\",\n \"Deep Panda\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"script_execution_via_wmi_filter\"\n }\n ]\n },\n {\n \"name\": \"Shim Database File Creation\",\n \"id\": \"6e4c4588-ba2f-42fa-97e6-9f6f548eaa33\",\n \"version\": 3,\n \"date\": \"2020-07-22\",\n \"description\": \"This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere.\",\n \"how_to_implement\": \"You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\\\AppPatch\\\\Custom* by Filesystem.file_name Filesystem.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`\",\n \"known_false_positives\": \"Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation.\",\n \"tags\": {\n \"analytics_story\": [\n \"Windows Persistence Techniques\"\n ],\n \"mitre_attack_id\": [\n \"T1546.011\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Application Shimming\"\n ],\n \"mitre_attack_tactics\": [\n \"Privilege Escalation\",\n \"Persistence\"\n ],\n \"mitre_attack_groups\": [\n \"FIN7\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"shim_database_file_creation_filter\"\n }\n ]\n },\n {\n \"name\": \"Shim Database Installation With Suspicious Parameters\",\n \"id\": \"404620de-46d8-48b6-90cc-8a8d7b0876a3\",\n \"version\": 3,\n \"date\": \"2020-07-22\",\n \"description\": \"This search detects the process execution and arguments required to silently create a shim database. The sdbinst.exe application is used to install shim database files (.sdb). A shim is a small library which transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe Processes.process=\\\"*-p*\\\" Processes.process=\\\"*-q*\\\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`\",\n \"known_false_positives\": \"None identified\",\n \"tags\": {\n \"analytics_story\": [\n \"Windows Persistence Techniques\"\n ],\n \"mitre_attack_id\": [\n \"T1546.011\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Application Shimming\"\n ],\n \"mitre_attack_tactics\": [\n \"Privilege Escalation\",\n \"Persistence\"\n ],\n \"mitre_attack_groups\": [\n \"FIN7\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"shim_database_installation_with_suspicious_parameters_filter\"\n }\n ]\n },\n {\n \"name\": \"Short Lived Windows Accounts\",\n \"id\": \"b25f6f62-0782-43c1-b403-083231ffd97d\",\n \"version\": 2,\n \"date\": \"2020-07-06\",\n \"description\": \"This search detects accounts that were created and deleted in a short time period.\",\n \"how_to_implement\": \"This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs. More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h All_Changes.user All_Changes.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(\\\"All_Changes\\\")` | search result_id = 4720 result_id=4726 | transaction user connected=false maxspan=240m | table firstTime lastTime count user dest result_id | `short_lived_windows_accounts_filter`\",\n \"known_false_positives\": \"It is possible that an administrator created and deleted an account in a short time period. Verifying activity with an administrator is advised.\",\n \"tags\": {\n \"analytics_story\": [\n \"Account Monitoring and Controls\"\n ],\n \"mitre_attack_id\": [\n \"T1136.001\"\n ],\n \"cis20\": [\n \"CIS 16\"\n ],\n \"nist\": [\n \"PR.IP\"\n ],\n \"security_domain\": \"access\",\n \"asset_type\": \"Windows\",\n \"mitre_attack_technique\": [\n \"Local Account\"\n ],\n \"mitre_attack_tactics\": [\n \"Persistence\"\n ],\n \"mitre_attack_groups\": [\n \"APT39\",\n \"APT41\",\n \"Dragonfly 2.0\",\n \"Leafminer\",\n \"APT3\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"short_lived_windows_accounts_filter\"\n }\n ]\n },\n {\n \"name\": \"Single Letter Process On Endpoint\",\n \"id\": \"a4214f0b-e01c-41bc-8cc4-d2b71e3056b4\",\n \"version\": 2,\n \"date\": \"2019-04-01\",\n \"description\": \"This search looks for process names that consist only of a single letter.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest, Processes.user, Processes.process, Processes.process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | eval process_name_length = len(process_name), endExe = if(substr(process_name, -4) == \\\".exe\\\", 1, 0) | search process_name_length=5 AND endExe=1 | table count, firstTime, lastTime, dest, user, process, process_name | `single_letter_process_on_endpoint_filter`\",\n \"known_false_positives\": \"Single-letter executables are not always malicious. Investigate this activity with your normal incident-response process.\",\n \"tags\": {\n \"analytics_story\": [\n \"DHS Report TA18-074A\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 2\"\n ],\n \"nist\": [\n \"ID.AM\",\n \"PR.DS\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"single_letter_process_on_endpoint_filter\"\n }\n ]\n },\n {\n \"name\": \"Spike in File Writes\",\n \"id\": \"fdb0f805-74e4-4539-8c00-618927333aae\",\n \"version\": 3,\n \"date\": \"2020-03-16\",\n \"description\": \"The search looks for a sharp increase in the number of files written to a particular host\",\n \"how_to_implement\": \"In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response products, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.action=created by _time span=1h, Filesystem.dest | `drop_dm_object_name(Filesystem)` | eventstats max(_time) as maxtime | stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, \\\"-1d@d\\\"), count, null))) as \\\"count\\\" avg(eval(if(_timelist all analytics stories
\n","urlObject":{"path":["stories"],"host":["https://content.splunkresearch.com"],"query":[],"variable":[]}},"response":[{"id":"e2430c3a-9c60-4f89-ba8e-f8bd4a5168b5","name":"/stories","originalRequest":{"method":"GET","header":[],"url":"https://content.splunkresearch.com/stories"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Date","value":"Thu, 05 Nov 2020 08:15:32 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Content-Length","value":"1209059"},{"key":"Connection","value":"keep-alive"},{"key":"x-amzn-RequestId","value":"0bbcabf6-efd3-4bc2-b202-c66e6357d474"},{"key":"Access-Control-Allow-Origin","value":"*"},{"key":"Access-Control-Allow-Headers","value":"Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key"},{"key":"x-amz-apigw-id","value":"VhknrFUtvHcFs0A="},{"key":"X-Amzn-Trace-Id","value":"Root=1-5fa3b497-645439d227429f7a135d13ae;Sampled=0"}],"cookie":[],"responseTime":null,"body":"{\n \"stories\": [\n {\n \"name\": \"Account Monitoring and Controls\",\n \"id\": \"8892a655-6205-55f7-abba-06460e38c8ae\",\n \"version\": 1,\n \"date\": \"2017-09-06\",\n \"description\": \"A common attack technique is to leverage user accounts to gain unauthorized access to the target's network. This Analytic Story minimizes opportunities for attack by helping you actively manage creation/use/dormancy/deletion--the lifecycle of system and application accounts.\",\n \"narrative\": \"Monitoring user accounts within your enterprise is a critical analytic function that helps ensure that credential and access policies/procedures are properly implemented and are being enforced. Proactive ad-hoc hunting, as well as routine monitoring, can ensure user or system accounts are not being abused by unauthorized individuals or processes. In the event of a network event or breach, user-authentication logs are a key resource in determining if or how an account might have been compromised or co-opted, leading to suspicious or malicious activity.\",\n \"author\": \"David Dorsey, Splunk\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"tags\": {\n \"analytics_story\": \"Account Monitoring and Controls\",\n \"usecase\": \"Security Monitoring\",\n \"category\": [\n \"Best Practices\"\n ],\n \"mitre_attack_id\": [\n \"T1078.003\",\n \"T1136.001\",\n \"T1078.002\"\n ],\n \"mitre_attack_technique\": [\n \"Local Accounts\",\n \"Domain Accounts\",\n \"Local Account\"\n ],\n \"mitre_attack_tactics\": [\n \"Privilege Escalation\",\n \"Defense Evasion\",\n \"Persistence\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"Tropic Trooper\",\n \"APT32\",\n \"Dragonfly 2.0\",\n \"APT3\",\n \"APT39\",\n \"Stolen Pencil\",\n \"APT41\",\n \"Threat Group-1314\",\n \"Leafminer\",\n \"TA505\",\n \"FIN10\"\n ]\n },\n \"detections\": [\n {\n \"name\": \"Identify New User Accounts\",\n \"id\": \"475b9e27-17e4-46e2-b7e2-648221be3b89\",\n \"version\": 1,\n \"date\": \"2017-09-12\",\n \"description\": \"This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the past week.\",\n \"how_to_implement\": \"To successfully implement this search, you need to be populating the Enterprise Security Identity_Management data model in the assets and identity framework.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| from datamodel Identity_Management.All_Identities | eval empStatus=case((now()-startDate)<604800, \\\"Accounts created in last week\\\") | search empStatus=\\\"Accounts created in last week\\\"| `security_content_ctime(endDate)` | `security_content_ctime(startDate)`| table identity empStatus endDate startDate | `identify_new_user_accounts_filter`\",\n \"known_false_positives\": \"If the Identity_Management data model is not updated regularly, this search could give you false positive alerts. Please consider this and investigate appropriately.\",\n \"tags\": {\n \"analytics_story\": [\n \"Account Monitoring and Controls\"\n ],\n \"mitre_attack_id\": [\n \"T1078.002\"\n ],\n \"cis20\": [\n \"CIS 16\"\n ],\n \"nist\": [\n \"PR.IP\"\n ],\n \"security_domain\": \"access\",\n \"asset_type\": \"Domain Server\",\n \"mitre_attack_technique\": [\n \"Domain Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Persistence\",\n \"Privilege Escalation\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"TA505\",\n \"APT3\",\n \"Threat Group-1314\"\n ]\n },\n \"macros\": [\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"identify_new_user_accounts_filter\"\n }\n ]\n },\n {\n \"name\": \"Detect Excessive Account Lockouts From Endpoint\",\n \"id\": \"c026e3dd-7e18-4abb-8f41-929e836efe74\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"This search identifies endpoints that have caused a relatively high number of account lockouts in a short period.\",\n \"how_to_implement\": \"You must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. \\\\\\n **Splunk>Phantom Playbook Integration**\\\\\\nIf Splunk>Phantom is also configured in your environment, a Playbook called \\\"Excessive Account Lockouts Enrichment and Response\\\" can be configured to run when any results are found by this detection search. The Playbook executes the Contextual and Investigative searches in this Story, conducts additional information gathering on Windows endpoints, and takes a response action to shut down the affected endpoint. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the correct hostname to the \\\"Phantom Instance\\\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. \\\\\\n(Playbook Link:`https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/`).\\\\\\n\",\n \"type\": \"ESCU\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result=\\\"lockout\\\" by All_Changes.dest All_Changes.result |`drop_dm_object_name(\\\"All_Changes\\\")` |`drop_dm_object_name(\\\"Account_Management\\\")`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_account_lockouts_from_endpoint_filter`\",\n \"known_false_positives\": \"It's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts.\",\n \"tags\": {\n \"analytics_story\": [\n \"Account Monitoring and Controls\"\n ],\n \"mitre_attack_id\": [\n \"T1078.003\"\n ],\n \"cis20\": [\n \"CIS 16\"\n ],\n \"nist\": [\n \"PR.IP\"\n ],\n \"security_domain\": \"access\",\n \"asset_type\": \"Windows\",\n \"mitre_attack_technique\": [\n \"Local Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Persistence\",\n \"Privilege Escalation\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"Tropic Trooper\",\n \"FIN10\",\n \"Stolen Pencil\",\n \"APT32\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"detect_excessive_account_lockouts_from_endpoint_filter\"\n }\n ]\n },\n {\n \"name\": \"Detect Excessive User Account Lockouts\",\n \"id\": \"95a7f9a5-6096-437e-a19e-86f42ac609bd\",\n \"version\": 3,\n \"date\": \"2020-07-21\",\n \"description\": \"This search detects user accounts that have been locked out a relatively high number of times in a short period.\",\n \"how_to_implement\": \"ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result=\\\"lockout\\\" by All_Changes.user All_Changes.result |`drop_dm_object_name(\\\"All_Changes\\\")` |`drop_dm_object_name(\\\"Account_Management\\\")`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter`\",\n \"known_false_positives\": \"It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts.\",\n \"tags\": {\n \"analytics_story\": [\n \"Account Monitoring and Controls\"\n ],\n \"mitre_attack_id\": [\n \"T1078.003\"\n ],\n \"cis20\": [\n \"CIS 16\"\n ],\n \"nist\": [\n \"PR.IP\"\n ],\n \"security_domain\": \"access\",\n \"asset_type\": \"Windows\",\n \"mitre_attack_technique\": [\n \"Local Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Persistence\",\n \"Privilege Escalation\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"Tropic Trooper\",\n \"FIN10\",\n \"Stolen Pencil\",\n \"APT32\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"detect_excessive_user_account_lockouts_filter\"\n }\n ]\n },\n {\n \"name\": \"Short Lived Windows Accounts\",\n \"id\": \"b25f6f62-0782-43c1-b403-083231ffd97d\",\n \"version\": 2,\n \"date\": \"2020-07-06\",\n \"description\": \"This search detects accounts that were created and deleted in a short time period.\",\n \"how_to_implement\": \"This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs. More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h All_Changes.user All_Changes.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(\\\"All_Changes\\\")` | search result_id = 4720 result_id=4726 | transaction user connected=false maxspan=240m | table firstTime lastTime count user dest result_id | `short_lived_windows_accounts_filter`\",\n \"known_false_positives\": \"It is possible that an administrator created and deleted an account in a short time period. Verifying activity with an administrator is advised.\",\n \"tags\": {\n \"analytics_story\": [\n \"Account Monitoring and Controls\"\n ],\n \"mitre_attack_id\": [\n \"T1136.001\"\n ],\n \"cis20\": [\n \"CIS 16\"\n ],\n \"nist\": [\n \"PR.IP\"\n ],\n \"security_domain\": \"access\",\n \"asset_type\": \"Windows\",\n \"mitre_attack_technique\": [\n \"Local Account\"\n ],\n \"mitre_attack_tactics\": [\n \"Persistence\"\n ],\n \"mitre_attack_groups\": [\n \"APT39\",\n \"APT41\",\n \"Dragonfly 2.0\",\n \"Leafminer\",\n \"APT3\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"short_lived_windows_accounts_filter\"\n }\n ]\n }\n ]\n },\n {\n \"name\": \"Apache Struts Vulnerability\",\n \"id\": \"2dcfd6a2-e7d2-4873-b6ba-adaf819d2a1e\",\n \"version\": 1,\n \"date\": \"2018-12-06\",\n \"description\": \"Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.\",\n \"narrative\": \"In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \\\\\\nThe exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\\\\\\nThis Analytic Story contains two different searches that help to identify activity that may be related to this issue. The first search looks for characteristics of the `Content-Type` header consistent with attempts to exploit the vulnerability. This should be a relatively pertinent indicator, as the `Content-Type` header is generally consistent and does not have a large degree of variation.\\\\\\nThe second search looks for the execution of various commands typically entered on the command shell when an attacker first lands on a system. These commands are not generally executed on web servers during the course of day-to-day operation, but they may be used when the system is undergoing maintenance or troubleshooting.\\\\\\nFirst, it is helpful is to understand how often the notable event is generated, as well as the commonalities in some of these events. This may help determine whether this is a common occurrence that is of a lesser concern or a rare event that may require more extensive investigation. It can also help to understand whether the issue is restricted to a single user or system or is broader in scope.\\\\\\nhen looking at the target of the behavior illustrated by the event, you should note the sensitivity of the user and or/system to help determine the potential impact. It is also helpful to see what other events involving the target have occurred in the recent past. This can help tie different events together and give further situational awareness regarding the target.\\\\\\nVarious types of information for external systems should be reviewed and (potentially) collected if the incident is, indeed, judged to be malicious. Information like this can be useful in generating your own threat intelligence to create alerts in the future.\\\\\\nLooking at the country, responsible party, and fully qualified domain names associated with the external IP address--as well as the registration information associated with those domain names, if they are frequently visited by others--can help you answer the question of \\\"who,\\\" in regard to the external system. Answering that can help qualify the event and may serve useful for tracking. In addition, there are various sources that can provide some reputation information on the IP address or domain name, which can assist in determining if the event is malicious in nature. Finally, determining whether or not there are other events associated with the IP address may help connect some dots or show other events that should be brought into scope.\\\\\\nGathering various data elements on the system of interest can sometimes help quickly determine that something suspicious may be happening. Some of these items include determining who else may have recently logged into the system, whether any unusual scheduled tasks exist, whether the system is communicating on suspicious ports, whether there are modifications to sensitive registry keys, and whether there are any known vulnerabilities on the system. This information can often highlight other activity commonly seen in attack scenarios or give more information about how the system may have been targeted.\\\\\\nhen a specific service or application is targeted, it is often helpful to know the associated version to help determine whether or not it is vulnerable to a specific exploit.\\\\\\nhen it is suspected there is an attack targeting a web server, it is helpful to look at some of the behavior of the web service to see if there is evidence that the service has been compromised. Some indications of this might be network connections to external resources, the web service spawning child processes that are not associated with typical behavior, and whether the service wrote any files that might be malicious in nature.\\\\\\nIn the event that a suspicious file is found, we can review more information about it to help determine if it is, in fact, malicious. Identifying the file type, any processes that have the file open, what processes created and/or modified the file, and the number of systems that may have this file can help to determine if the file is malicious. Also, determining the file hash and checking it against reputation sources, such as VirusTotal, can sometimes quickly help determine whether it is malicious in nature.\\\\\\nOften, a simple inspection of a suspect process name and path can tell you if the system has been compromised. For example, if `svchost.exe` is found running from a location other than `C:\\\\Windows\\\\System32`, it is likely something malicious designed to hide in plain sight when simply reviewing process names. Similarly, if the process itself seems legitimate, but the parent process is running from the temporary browser cache, there may be activity initiated via a compromised website the user visited.\\\\\\nIt can also be very helpful to examine various behaviors of the process of interest or the parent of the process that is of interest. For example, if it turns out that the process of interest is malicious, it would be good to see if the parent to that process spawned other processes that might also be worth further scrutiny. If a process is suspect, reviewing the network connections made around the time of the event and/or if the process spawned any child processes could be helpful in determining whether it is malicious or executing a malicious script.\",\n \"author\": \"Rico Valdez, Splunk\",\n \"type\": \"ESCU\",\n \"references\": [\n \"https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf\"\n ],\n \"tags\": {\n \"analytics_story\": \"Apache Struts Vulnerability\",\n \"usecase\": \"Advanced Threat Detection\",\n \"category\": [\n \"Vulnerability\"\n ],\n \"mitre_attack_id\": [\n \"T1082\"\n ],\n \"mitre_attack_technique\": [\n \"System Information Discovery\"\n ],\n \"mitre_attack_tactics\": [\n \"Discovery\"\n ],\n \"mitre_attack_groups\": [\n \"MuddyWater\",\n \"Lazarus Group\",\n \"Gamaredon Group\",\n \"Honeybee\",\n \"Frankenstein\",\n \"APT18\",\n \"Tropic Trooper\",\n \"APT32\",\n \"Patchwork\",\n \"Turla\",\n \"Sandworm Team\",\n \"Sowbug\",\n \"APT19\",\n \"APT37\",\n \"Blue Mockingbird\",\n \"Stealth Falcon\",\n \"admin@338\",\n \"Magic Hound\",\n \"Inception\",\n \"Kimsuky\",\n \"APT3\",\n \"Darkhotel\",\n \"OilRig\",\n \"Rocke\",\n \"Ke3chang\"\n ]\n },\n \"detections\": [\n {\n \"name\": \"Suspicious Java Classes\",\n \"id\": \"if1fea6da-3c86-4c1d-b255-fc3b2781a491\",\n \"version\": 1,\n \"date\": \"2018-12-06\",\n \"description\": \"This search looks for suspicious Java classes that are often used to exploit remote command execution in common Java frameworks, such as Apache Struts.\",\n \"how_to_implement\": \"In order to properly run this search, Splunk needs to ingest data from your web-traffic appliances that serve or sit in the path of your Struts application servers. This can be accomplished by indexing data from a web proxy, or by using network traffic-analysis tools, such as Splunk Stream or Bro.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Jose Hernandez, Splunk\",\n \"search\": \"`stream_http` http_method=POST http_content_length>1 | regex form_data=\\\"(?i)java\\\\.lang\\\\.(?:runtime|processbuilder)\\\" | rename src_ip as src | stats count earliest(_time) as firstTime, latest(_time) as lastTime, values(url) as uri, values(status) as status, values(http_user_agent) as http_user_agent by src, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_java_classes_filter`\",\n \"known_false_positives\": \"There are no known false positives.\",\n \"tags\": {\n \"analytics_story\": [\n \"Apache Struts Vulnerability\"\n ],\n \"kill_chain_phases\": [\n \"Exploitation\"\n ],\n \"cis20\": [\n \"CIS 7\",\n \"CIS 12\"\n ],\n \"nist\": [\n \"DE.AE\"\n ],\n \"security_domain\": \"threat\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"sourcetype=stream:http\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"stream_http\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"suspicious_java_classes_filter\"\n }\n ]\n },\n {\n \"name\": \"Unusually Long Content-Type Length\",\n \"id\": \"57a0a2bf-353f-40c1-84dc-29293f3c35b7\",\n \"version\": 1,\n \"date\": \"2017-10-13\",\n \"description\": \"This search looks for unusually long strings in the Content-Type http header that the client sends the server.\",\n \"how_to_implement\": \"This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`stream_http` | eval cs_content_type_length = len(cs_content_type) | where cs_content_type_length > 100 | table endtime src_ip dest_ip cs_content_type_length cs_content_type url | `unusually_long_content_type_length_filter`\",\n \"known_false_positives\": \"Very few legitimate Content-Type fields will have a length greater than 100 characters.\",\n \"tags\": {\n \"analytics_story\": [\n \"Apache Struts Vulnerability\"\n ],\n \"kill_chain_phases\": [\n \"Delivery\"\n ],\n \"cis20\": [\n \"CIS 3\",\n \"CIS 4\",\n \"CIS 18\",\n \"CIS 12\"\n ],\n \"nist\": [\n \"ID.RA\",\n \"RS.MI\",\n \"PR.PT\",\n \"PR.IP\",\n \"DE.AE\",\n \"PR.MA\",\n \"DE.CM\"\n ],\n \"security_domain\": \"network\",\n \"asset_type\": \"Web Server\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"sourcetype=stream:http\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"stream_http\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"unusually_long_content_type_length_filter\"\n }\n ]\n },\n {\n \"name\": \"Web Servers Executing Suspicious Processes\",\n \"id\": \"ec3b7601-689a-4463-94e0-c9f45638efb9\",\n \"version\": 1,\n \"date\": \"2019-04-01\",\n \"description\": \"This search looks for suspicious processes on all systems labeled as web servers.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model. In addition, web servers will need to be identified in the Assets and Identity Framework of Enterprise Security.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.dest_category=\\\"web_server\\\" AND (Processes.process=\\\"*whoami*\\\" OR Processes.process=\\\"*ping*\\\" OR Processes.process=\\\"*iptables*\\\" OR Processes.process=\\\"*wget*\\\" OR Processes.process=\\\"*service*\\\" OR Processes.process=\\\"*curl*\\\") by Processes.process Processes.process_name, Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_servers_executing_suspicious_processes_filter`\",\n \"known_false_positives\": \"Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks.\",\n \"tags\": {\n \"analytics_story\": [\n \"Apache Struts Vulnerability\"\n ],\n \"mitre_attack_id\": [\n \"T1082\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 3\"\n ],\n \"nist\": [\n \"PR.IP\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Web Server\",\n \"mitre_attack_technique\": [\n \"System Information Discovery\"\n ],\n \"mitre_attack_tactics\": [\n \"Discovery\"\n ],\n \"mitre_attack_groups\": [\n \"Rocke\",\n \"Sandworm Team\",\n \"Blue Mockingbird\",\n \"Tropic Trooper\",\n \"Frankenstein\",\n \"Inception\",\n \"Kimsuky\",\n \"Darkhotel\",\n \"MuddyWater\",\n \"APT18\",\n \"Honeybee\",\n \"APT19\",\n \"APT37\",\n \"APT32\",\n \"Magic Hound\",\n \"OilRig\",\n \"APT3\",\n \"Sowbug\",\n \"Gamaredon Group\",\n \"Patchwork\",\n \"Stealth Falcon\",\n \"Lazarus Group\",\n \"admin@338\",\n \"Turla\",\n \"Ke3chang\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"web_servers_executing_suspicious_processes_filter\"\n }\n ]\n }\n ]\n },\n {\n \"name\": \"Asset Tracking\",\n \"id\": \"91c676cf-0b23-438d-abee-f6335e1fce77\",\n \"version\": 1,\n \"date\": \"2017-09-13\",\n \"description\": \"Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further.\",\n \"narrative\": \"This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"type\": \"ESCU\",\n \"references\": [\n \"https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/\"\n ],\n \"tags\": {\n \"analytics_story\": \"Asset Tracking\",\n \"usecase\": \"Security Monitoring\",\n \"category\": [\n \"Best Practices\"\n ],\n \"mitre_attack_id\": [],\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"detections\": [\n {\n \"name\": \"Detect Unauthorized Assets by MAC address\",\n \"id\": \"dcfd6b40-42f9-469d-a433-2e53f7489ff4\",\n \"version\": 1,\n \"date\": \"2017-09-13\",\n \"description\": \"By populating the organization's assets within the assets_by_str.csv, we will be able to detect unauthorized devices that are trying to connect with the organization's network by inspecting DHCP request packets, which are issued by devices when they attempt to obtain an IP address from the DHCP server. The MAC address associated with the source of the DHCP request is checked against the list of known devices, and reports on those that are not found.\",\n \"how_to_implement\": \"This search uses the Network_Sessions data model shipped with Enterprise Security. It leverages the Assets and Identity framework to populate the assets_by_str.csv file located in SA-IdentityManagement, which will contain a list of known authorized organizational assets including their MAC addresses. Ensure that all inventoried systems have their MAC address populated.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip All_Sessions.src_mac | dedup All_Sessions.src_mac| `drop_dm_object_name(\\\"Network_Sessions\\\")`|`drop_dm_object_name(\\\"All_Sessions\\\")` | search NOT [| inputlookup asset_lookup_by_str |rename mac as src_mac | fields + src_mac] | `detect_unauthorized_assets_by_mac_address_filter`\",\n \"known_false_positives\": \"This search might be prone to high false positives. Please consider this when conducting analysis or investigations. Authorized devices may be detected as unauthorized. If this is the case, verify the MAC address of the system responsible for the false positive and add it to the Assets and Identity framework with the proper information.\",\n \"tags\": {\n \"analytics_story\": [\n \"Asset Tracking\"\n ],\n \"kill_chain_phases\": [\n \"Reconnaissance\",\n \"Delivery\",\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 1\"\n ],\n \"nist\": [\n \"ID.AM\",\n \"PR.DS\"\n ],\n \"security_domain\": \"network\",\n \"asset_type\": \"Infrastructure\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"baselines\": [\n {\n \"name\": \"Count of assets by category\",\n \"id\": \"dcfd6b40-42f9-469d-a433-2e53f7489ff9\",\n \"version\": 1,\n \"date\": \"2017-09-13\",\n \"description\": \"This search shows you every asset category you have and the assets that belong to those categories.\",\n \"how_to_implement\": \"To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| from datamodel Identity_Management.All_Assets | stats count values(nt_host) by category | sort -count\",\n \"tags\": {\n \"analytics_story\": [\n \"Asset Tracking\"\n ],\n \"detections\": [\n \"Detect Unauthorized Assets by MAC address\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"detect_unauthorized_assets_by_mac_address_filter\"\n }\n ]\n }\n ]\n },\n {\n \"name\": \"AWS Cross Account Activity\",\n \"id\": \"2f2f610a-d64d-48c2-b57c-967a2b49ab5a\",\n \"version\": 1,\n \"date\": \"2018-06-04\",\n \"description\": \"Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.\",\n \"narrative\": \"Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\\\\\\nHerein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\\\\\\nThis Analytic Story includes searches that will help you monitor your AWS CloudTrail logs for evidence of suspicious cross-account activity. For example, while accessing multiple AWS accounts and roles may be perfectly valid behavior, it may be suspicious when an account requests privileges of an account it has not accessed in the past. After identifying suspicious activities, you can use the provided investigative searches to help you probe more deeply.\",\n \"author\": \"David Dorsey, Splunk\",\n \"type\": \"ESCU\",\n \"references\": [\n \"https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/\"\n ],\n \"tags\": {\n \"analytics_story\": \"AWS Cross Account Activity\",\n \"usecase\": \"Security Monitoring\",\n \"category\": [\n \"Cloud Security\"\n ],\n \"mitre_attack_id\": [\n \"T1550\",\n \"T1078.004\",\n \"T1078\"\n ],\n \"mitre_attack_technique\": [\n \"Valid Accounts\",\n \"Cloud Accounts\",\n \"Use Alternate Authentication Material\"\n ],\n \"mitre_attack_tactics\": [\n \"Persistence\",\n \"Privilege Escalation\",\n \"Defense Evasion\",\n \"Lateral Movement\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"Dragonfly 2.0\",\n \"Soft Cell\",\n \"APT41\",\n \"Threat Group-3390\",\n \"Night Dragon\",\n \"FIN10\",\n \"APT18\",\n \"TEMP.Veles\",\n \"APT28\",\n \"FIN8\",\n \"Sandworm Team\",\n \"Silence\",\n \"menuPass\",\n \"Suckfly\",\n \"APT39\",\n \"Carbanak\",\n \"FIN5\",\n \"Wizard Spider\",\n \"Leviathan\",\n \"OilRig\",\n \"FIN6\",\n \"FIN4\",\n \"no\",\n \"PittyTiger\",\n \"APT33\"\n ]\n },\n \"detections\": [\n {\n \"name\": \"AWS Cross Account Activity From Previously Unseen Account\",\n \"id\": \"64fbbddf-fabf-4edf-80b3-0cc36ef37727\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for AssumeRole events where an IAM role in a different account is requested for the first time.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Run the `Previously Seen AWS Cross Account Activity` support search only once to create the baseline of previously seen cross account activity. Thanks to Pablo Vega at Recurly for suggesting improvements to the search.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId != requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | multireport [| stats min(eval(coalesce(firstTime, _time))) as firstTime max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | where fact=fiction] [| eventstats min(eval(coalesce(firstTime, _time))) as firstTime, max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | where firstTime >= relative_time(now(), \\\"-70m@m\\\") AND isnotnull(_time) | spath output=accessKeyId path=responseElements.credentials.accessKeyId | spath output=requestingARN path=resources{}.ARN | stats values(awsRegion) as awsRegion values(firstTime) as firstTime values(lastTime) as lastTime values(sharedEventID) as sharedEventID, values(requestingARN) as src_user, values(responseElements.assumedRoleUser.arn) as dest_user by _time, requestingAccountId, requestedAccountId, accessKeyId] | table _time, firstTime, lastTime, src_user, requestingAccountId, dest_user, requestedAccountId, awsRegion, accessKeyId, sharedEventID | `aws_cross_account_activity_from_previously_unseen_account_filter`\",\n \"known_false_positives\": \"Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request.\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cross Account Activity\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"mitre_attack_id\": [\n \"T1078.004\"\n ],\n \"cis20\": [\n \"CIS 16\"\n ],\n \"nist\": [\n \"PR.AC\",\n \"PR.DS\",\n \"DE.AE\"\n ],\n \"security_domain\": \"network\",\n \"asset_type\": \"AWS Instance\",\n \"mitre_attack_technique\": [\n \"Cloud Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Persistence\",\n \"Privilege Escalation\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"APT33\"\n ]\n },\n \"baselines\": [\n {\n \"name\": \"Previously Seen AWS Cross Account Activity\",\n \"id\": \"1cc22b09-c867-416e-a511-cb36ac44aee2\",\n \"version\": 1,\n \"date\": \"2018-06-04\",\n \"description\": \"This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"`cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cross Account Activity\"\n ],\n \"detections\": [\n \"AWS Cross Account Activity From Previously Unseen Account\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"aws_cross_account_activity_from_previously_unseen_account_filter\"\n }\n ]\n },\n {\n \"author\": \"Rod Soto, Splunk\",\n \"date\": \"2020-07-27\",\n \"description\": \"This search provides detection of an user attaching itself to a different role trust policy. This can be used for lateral movement and escalation of privileges.\",\n \"how_to_implement\": \"You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs\",\n \"id\": \"88fc31dd-f331-448c-9856-d3d51dd5d3a1\",\n \"known_false_positives\": \"Attach to policy can create a lot of noise. This search can be adjusted to provide specific values to identify cases of abuse (i.e status=failure). The search can provide context for common users attaching themselves to higher privilege policies or even newly created policies.\",\n \"name\": \"aws detect attach to role policy\",\n \"references\": [],\n \"search\": \"`aws_cloudwatchlogs_eks` attach policy| spath requestParameters.policyArn | table sourceIPAddress user_access_key userIdentity.arn userIdentity.sessionContext.sessionIssuer.arn eventName errorCode errorMessage status action requestParameters.policyArn userIdentity.sessionContext.attributes.mfaAuthenticated userIdentity.sessionContext.attributes.creationDate | `aws_detect_attach_to_role_policy_filter`\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cross Account Activity\"\n ],\n \"asset_type\": \"AWS Account\",\n \"kill_chain_phases\": [\n \"Lateral Movement\"\n ],\n \"mitre_attack_id\": [\n \"T1078\"\n ],\n \"security_domain\": \"threat\",\n \"mitre_attack_technique\": [\n \"Valid Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Persistence\",\n \"Privilege Escalation\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"Sandworm Team\",\n \"Wizard Spider\",\n \"Silence\",\n \"APT41\",\n \"Soft Cell\",\n \"TEMP.Veles\",\n \"APT39\",\n \"FIN4\",\n \"Night Dragon\",\n \"Dragonfly 2.0\",\n \"FIN8\",\n \"Leviathan\",\n \"APT33\",\n \"OilRig\",\n \"FIN5\",\n \"menuPass\",\n \"APT28\",\n \"FIN10\",\n \"Suckfly\",\n \"FIN6\",\n \"Threat Group-3390\",\n \"APT18\",\n \"PittyTiger\",\n \"Carbanak\"\n ]\n },\n \"type\": \"ESCU\",\n \"version\": 1,\n \"macros\": [\n {\n \"definition\": \"sourcetype=\\\"aws:cloudwatchlogs:eks\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"aws_cloudwatchlogs_eks\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"aws_detect_attach_to_role_policy_filter\"\n }\n ]\n },\n {\n \"author\": \"Rod Soto, Splunk\",\n \"date\": \"2020-07-27\",\n \"description\": \"This search provides detection of accounts creating permanent keys. Permanent keys are not created by default and they are only needed for programmatic calls. Creation of Permanent key is an important event to monitor.\",\n \"how_to_implement\": \"You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs\",\n \"id\": \"12d6d713-3cb4-4ffc-a064-1dca3d1cca01\",\n \"known_false_positives\": \"Not all permanent key creations are malicious. If there is a policy of rotating keys this search can be adjusted to provide better context.\",\n \"name\": \"aws detect permanent key creation\",\n \"references\": [],\n \"search\": \"`aws_cloudwatchlogs_eks` CreateAccessKey | spath eventName | search eventName=CreateAccessKey \\\"userIdentity.type\\\"=IAMUser | table sourceIPAddress userName userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId |`aws_detect_permanent_key_creation_filter`\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cross Account Activity\"\n ],\n \"asset_type\": \"AWS Account\",\n \"kill_chain_phases\": [\n \"Lateral Movement\"\n ],\n \"mitre_attack_id\": [\n \"T1078\"\n ],\n \"security_domain\": \"threat\",\n \"mitre_attack_technique\": [\n \"Valid Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Persistence\",\n \"Privilege Escalation\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"Sandworm Team\",\n \"Wizard Spider\",\n \"Silence\",\n \"APT41\",\n \"Soft Cell\",\n \"TEMP.Veles\",\n \"APT39\",\n \"FIN4\",\n \"Night Dragon\",\n \"Dragonfly 2.0\",\n \"FIN8\",\n \"Leviathan\",\n \"APT33\",\n \"OilRig\",\n \"FIN5\",\n \"menuPass\",\n \"APT28\",\n \"FIN10\",\n \"Suckfly\",\n \"FIN6\",\n \"Threat Group-3390\",\n \"APT18\",\n \"PittyTiger\",\n \"Carbanak\"\n ]\n },\n \"type\": \"ESCU\",\n \"version\": 1,\n \"macros\": [\n {\n \"definition\": \"sourcetype=\\\"aws:cloudwatchlogs:eks\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"aws_cloudwatchlogs_eks\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"aws_detect_permanent_key_creation_filter\"\n }\n ]\n },\n {\n \"author\": \"Rod Soto, Splunk\",\n \"date\": \"2020-07-27\",\n \"description\": \"This search provides detection of role creation by IAM users. Role creation is an event by itself if user is creating a new role with trust policies different than the available in AWS and it can be used for lateral movement and escalation of privileges.\",\n \"how_to_implement\": \"You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs\",\n \"id\": \"5f04081e-ddee-4353-afe4-504f288de9ad\",\n \"known_false_positives\": \"CreateRole is not very common in common users. This search can be adjusted to provide specific values to identify cases of abuse. In general AWS provides plenty of trust policies that fit most use cases.\",\n \"name\": \"aws detect role creation\",\n \"references\": [],\n \"search\": \"`aws_cloudwatchlogs_eks` event_name=CreateRole action=created userIdentity.type=AssumedRole requestParameters.description=Allows* | table sourceIPAddress userIdentity.principalId userIdentity.arn action event_name awsRegion http_user_agent mfa_auth msg requestParameters.roleName requestParameters.description responseElements.role.arn responseElements.role.createDate | `aws_detect_role_creation_filter`\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cross Account Activity\"\n ],\n \"asset_type\": \"AWS Account\",\n \"kill_chain_phases\": [\n \"Lateral Movement\"\n ],\n \"mitre_attack_id\": [\n \"T1078\"\n ],\n \"security_domain\": \"threat\",\n \"mitre_attack_technique\": [\n \"Valid Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Persistence\",\n \"Privilege Escalation\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"Sandworm Team\",\n \"Wizard Spider\",\n \"Silence\",\n \"APT41\",\n \"Soft Cell\",\n \"TEMP.Veles\",\n \"APT39\",\n \"FIN4\",\n \"Night Dragon\",\n \"Dragonfly 2.0\",\n \"FIN8\",\n \"Leviathan\",\n \"APT33\",\n \"OilRig\",\n \"FIN5\",\n \"menuPass\",\n \"APT28\",\n \"FIN10\",\n \"Suckfly\",\n \"FIN6\",\n \"Threat Group-3390\",\n \"APT18\",\n \"PittyTiger\",\n \"Carbanak\"\n ]\n },\n \"type\": \"ESCU\",\n \"version\": 1,\n \"macros\": [\n {\n \"definition\": \"sourcetype=\\\"aws:cloudwatchlogs:eks\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"aws_cloudwatchlogs_eks\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"aws_detect_role_creation_filter\"\n }\n ]\n },\n {\n \"author\": \"Rod Soto, Splunk\",\n \"date\": \"2020-07-27\",\n \"description\": \"This search provides detection of suspicious use of sts:AssumeRole. These tokens can be created on the go and used by attackers to move laterally and escalate privileges.\",\n \"how_to_implement\": \"You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs\",\n \"id\": \"8e565314-b6a2-46d8-9f05-1a34a176a662\",\n \"known_false_positives\": \"Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. This search can be adjusted to provide specific values to identify cases of abuse.\",\n \"name\": \"aws detect sts assume role abuse\",\n \"references\": [],\n \"search\": \"`cloudtrail` user_type=AssumedRole userIdentity.sessionContext.sessionIssuer.type=Role | table sourceIPAddress userIdentity.arn user_agent user_access_key status action requestParameters.roleName responseElements.role.roleName responseElements.role.createDate | `aws_detect_sts_assume_role_abuse_filter`\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cross Account Activity\"\n ],\n \"asset_type\": \"AWS Account\",\n \"kill_chain_phases\": [\n \"Lateral Movement\"\n ],\n \"mitre_attack_id\": [\n \"T1078\"\n ],\n \"security_domain\": \"threat\",\n \"mitre_attack_technique\": [\n \"Valid Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Persistence\",\n \"Privilege Escalation\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"Sandworm Team\",\n \"Wizard Spider\",\n \"Silence\",\n \"APT41\",\n \"Soft Cell\",\n \"TEMP.Veles\",\n \"APT39\",\n \"FIN4\",\n \"Night Dragon\",\n \"Dragonfly 2.0\",\n \"FIN8\",\n \"Leviathan\",\n \"APT33\",\n \"OilRig\",\n \"FIN5\",\n \"menuPass\",\n \"APT28\",\n \"FIN10\",\n \"Suckfly\",\n \"FIN6\",\n \"Threat Group-3390\",\n \"APT18\",\n \"PittyTiger\",\n \"Carbanak\"\n ]\n },\n \"type\": \"ESCU\",\n \"version\": 1,\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"aws_detect_sts_assume_role_abuse_filter\"\n }\n ]\n },\n {\n \"author\": \"Rod Soto, Splunk\",\n \"date\": \"2020-07-27\",\n \"description\": \"This search provides detection of suspicious use of sts:GetSessionToken. These tokens can be created on the go and used by attackers to move laterally and escalate privileges.\",\n \"how_to_implement\": \"You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs\",\n \"id\": \"85d7b35f-b8b5-4b01-916f-29b81e7a0551\",\n \"known_false_positives\": \"Sts:GetSessionToken can be very noisy as in certain environments numerous calls of this type can be executed. This search can be adjusted to provide specific values to identify cases of abuse. In specific environments the use of field requestParameters.serialNumber will need to be used.\",\n \"name\": \"aws detect sts get session token abuse\",\n \"references\": [],\n \"search\": \"`aws_cloudwatchlogs_eks` ASIA userIdentity.type=IAMUser| spath eventName | search eventName=GetSessionToken | table sourceIPAddress eventTime userIdentity.arn userName userAgent user_type status region | `aws_detect_sts_get_session_token_abuse_filter`\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cross Account Activity\"\n ],\n \"asset_type\": \"AWS Account\",\n \"kill_chain_phases\": [\n \"Lateral Movement\"\n ],\n \"mitre_attack_id\": [\n \"T1550\"\n ],\n \"security_domain\": \"threat\",\n \"mitre_attack_technique\": [\n \"Use Alternate Authentication Material\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Lateral Movement\"\n ],\n \"mitre_attack_groups\": [\n \"no\"\n ]\n },\n \"type\": \"ESCU\",\n \"version\": 1,\n \"macros\": [\n {\n \"definition\": \"sourcetype=\\\"aws:cloudwatchlogs:eks\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"aws_cloudwatchlogs_eks\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"aws_detect_sts_get_session_token_abuse_filter\"\n }\n ]\n }\n ]\n },\n {\n \"name\": \"AWS Cryptomining\",\n \"id\": \"ced74200-8465-4bc3-bd2c-9a782eec6750\",\n \"version\": 1,\n \"date\": \"2018-03-08\",\n \"description\": \"Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.\",\n \"narrative\": \"Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \\\\\\nCryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS). It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \\\\\\nhen malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So, it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \\\\\\nThis Analytic Story is focused on detecting suspicious new instances in your EC2 environment to help prevent such a disaster. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.\",\n \"author\": \"David Dorsey, Splunk\",\n \"type\": \"ESCU\",\n \"references\": [\n \"https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf\"\n ],\n \"tags\": {\n \"analytics_story\": \"AWS Cryptomining\",\n \"usecase\": \"Security Monitoring\",\n \"category\": [\n \"Cloud Security\"\n ],\n \"mitre_attack_id\": [\n \"T1535\",\n \"T1078.004\"\n ],\n \"mitre_attack_technique\": [\n \"Unused/Unsupported Cloud Regions\",\n \"Cloud Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Privilege Escalation\",\n \"Defense Evasion\",\n \"Persistence\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"no\",\n \"APT33\"\n ]\n },\n \"detections\": [\n {\n \"name\": \"Abnormally High AWS Instances Launched by User\",\n \"id\": \"2a9b80d3-6340-4345-b5ad-290bf5d0dac4\",\n \"version\": 2,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m _time | stats count AS instances_launched by _time userName | eventstats avg(instances_launched) as total_launched_avg, stdev(instances_launched) as total_launched_stdev | eval threshold_value = 4 | eval isOutlier=if(instances_launched > total_launched_avg+(total_launched_stdev * threshold_value), 1, 0) | search isOutlier=1 AND _time >= relative_time(now(), \\\"-10m@m\\\") | eval num_standard_deviations_away = round(abs(instances_launched - total_launched_avg) / total_launched_stdev, 2) | table _time, userName, instances_launched, num_standard_deviations_away, total_launched_avg, total_launched_stdev | `abnormally_high_aws_instances_launched_by_user_filter`\",\n \"known_false_positives\": \"Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cryptomining\",\n \"Suspicious AWS EC2 Activities\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"mitre_attack_id\": [\n \"T1078.004\"\n ],\n \"cis20\": [\n \"CIS 13\"\n ],\n \"nist\": [\n \"DE.DP\",\n \"DE.AE\"\n ],\n \"security_domain\": \"network\",\n \"asset_type\": \"AWS Instance\",\n \"risk_score\": 40,\n \"risk_object_type\": \"user\",\n \"risk_object\": \"userName\",\n \"mitre_attack_technique\": [\n \"Cloud Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Persistence\",\n \"Privilege Escalation\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"APT33\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"abnormally_high_aws_instances_launched_by_user_filter\"\n }\n ]\n },\n {\n \"name\": \"EC2 Instance Started In Previously Unseen Region\",\n \"id\": \"ada0f478-84a8-4641-a3f3-d82362d6fd75\",\n \"version\": 1,\n \"date\": \"2018-02-23\",\n \"description\": \"This search looks for CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Run the \\\"Previously seen AWS Regions\\\" support search only once to create of baseline of previously seen regions.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` earliest=-1h StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | inputlookup append=t previously_seen_aws_regions.csv | stats min(earliest) as earliest max(latest) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | eval regionStatus=if(earliest >= relative_time(now(),\\\"-1d@d\\\"), \\\"Instance Started in a New Region\\\",\\\"Previously Seen Region\\\") | `security_content_ctime(earliest)` | `security_content_ctime(latest)` | where regionStatus=\\\"Instance Started in a New Region\\\" | `ec2_instance_started_in_previously_unseen_region_filter`\",\n \"known_false_positives\": \"It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cryptomining\",\n \"Suspicious AWS EC2 Activities\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"mitre_attack_id\": [\n \"T1535\"\n ],\n \"cis20\": [\n \"CIS 12\"\n ],\n \"nist\": [\n \"DE.DP\",\n \"DE.AE\"\n ],\n \"security_domain\": \"network\",\n \"asset_type\": \"AWS Instance\",\n \"mitre_attack_technique\": [\n \"Unused/Unsupported Cloud Regions\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\"\n ],\n \"mitre_attack_groups\": [\n \"no\"\n ]\n },\n \"baselines\": [\n {\n \"name\": \"Previously Seen AWS Regions\",\n \"id\": \"fc0edc95-ff2b-48b0-9f6f-63da3789fd63\",\n \"version\": 1,\n \"date\": \"2018-01-08\",\n \"description\": \"This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cryptomining\",\n \"Suspicious AWS EC2 Activities\"\n ],\n \"detections\": [\n \"EC2 Instance Started In Previously Unseen Region\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"ec2_instance_started_in_previously_unseen_region_filter\"\n }\n ]\n },\n {\n \"name\": \"EC2 Instance Started With Previously Unseen AMI\",\n \"id\": \"347ec301-601b-48b9-81aa-9ddf9c829dd3\",\n \"version\": 1,\n \"date\": \"2018-03-12\",\n \"description\": \"This search looks for EC2 instances being created with previously unseen AMIs.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the \\\"Previously Seen EC2 AMIs\\\" support search once to create a history of previously seen AMIs.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime by requestParameters.instancesSet.items{}.imageId | rename requestParameters.instancesSet.items{}.imageId as amiID | inputlookup append=t previously_seen_ec2_amis.csv | stats min(firstTime) as firstTime max(lastTime) as lastTime by amiID | outputlookup previously_seen_ec2_amis.csv | eval newAMI=if(firstTime >= relative_time(now(), \\\"-70m@m\\\"), 1, 0) | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | where newAMI=1 | rename amiID as requestParameters.instancesSet.items{}.imageId | table requestParameters.instancesSet.items{}.imageId] | rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn as arn, requestParameters.instancesSet.items{}.imageId as amiID | table firstTime, lastTime, arn, amiID, dest, instanceType | `ec2_instance_started_with_previously_unseen_ami_filter`\",\n \"known_false_positives\": \"After a new AMI is created, the first systems created with that AMI will cause this alert to fire. Verify that the AMI being used was created by a legitimate user.\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cryptomining\"\n ],\n \"cis20\": [\n \"CIS 1\"\n ],\n \"nist\": [\n \"ID.AM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"AWS Instance\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"baselines\": [\n {\n \"name\": \"Previously Seen EC2 AMIs\",\n \"id\": \"bb1bd99d-1e93-45f1-9571-cfed42d372b9\",\n \"version\": 1,\n \"date\": \"2018-03-12\",\n \"description\": \"This search builds a table of previously seen AMIs used to launch EC2 instances\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID | outputlookup previously_seen_ec2_amis.csv | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cryptomining\"\n ],\n \"detections\": [\n \"EC2 Instance Started With Previously Unseen AMI\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"ec2_instance_started_with_previously_unseen_ami_filter\"\n }\n ]\n },\n {\n \"name\": \"EC2 Instance Started With Previously Unseen Instance Type\",\n \"id\": \"65541c80-03c7-4e05-83c8-1dcd57a2e1ad\",\n \"version\": 2,\n \"date\": \"2020-02-07\",\n \"description\": \"This search looks for EC2 instances being created with previously unseen instance types.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the \\\"Previously Seen EC2 Instance Types\\\" support search once to create a history of previously seen instance types.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success | fillnull value=\\\"m1.small\\\" requestParameters.instanceType | stats earliest(_time) as earliest latest(_time) as latest by requestParameters.instanceType | rename requestParameters.instanceType as instanceType | inputlookup append=t previously_seen_ec2_instance_types.csv | stats min(earliest) as earliest max(latest) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv | eval newType=if(earliest >= relative_time(now(), \\\"-70m@m\\\"), 1, 0) | `security_content_ctime(earliest)` | `security_content_ctime(latest)` | where newType=1 | rename instanceType as requestParameters.instanceType | table requestParameters.instanceType] | spath output=user userIdentity.arn | rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_instance_type_filter`\",\n \"known_false_positives\": \"It is possible that an admin will create a new system using a new instance type never used before. Verify with the creator that they intended to create the system with the new instance type.\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cryptomining\"\n ],\n \"cis20\": [\n \"CIS 1\"\n ],\n \"nist\": [\n \"ID.AM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"AWS Instance\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"baselines\": [\n {\n \"name\": \"Previously Seen EC2 Instance Types\",\n \"id\": \"b8f029f2-65a6-4d76-be98-dad1c9d59c45\",\n \"version\": 1,\n \"date\": \"2018-03-08\",\n \"description\": \"This search builds a table of previously seen EC2 instance types\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value=\\\"m1.small\\\" instanceType | stats earliest(_time) as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cryptomining\"\n ],\n \"detections\": [\n \"EC2 Instance Started With Previously Unseen Instance Type\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"ec2_instance_started_with_previously_unseen_instance_type_filter\"\n }\n ]\n },\n {\n \"name\": \"EC2 Instance Started With Previously Unseen User\",\n \"id\": \"22773e84-bac0-4595-b086-20d3f735b4f1\",\n \"version\": 2,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for EC2 instances being created by users who have not created them before.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the \\\"Previously Seen EC2 Launches By User\\\" support search once to create a history of previously seen ARNs.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user.csv | stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | eval newUser=if(firstTime >= relative_time(now(), \\\"-70m@m\\\"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`\",\n \"known_false_positives\": \"It's possible that a user will start to create EC2 instances when they haven't before for any number of reasons. Verify with the user that is launching instances that this is the intended behavior.\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cryptomining\",\n \"Suspicious AWS EC2 Activities\"\n ],\n \"mitre_attack_id\": [\n \"T1078.004\"\n ],\n \"cis20\": [\n \"CIS 1\"\n ],\n \"nist\": [\n \"ID.AM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"AWS Instance\",\n \"mitre_attack_technique\": [\n \"Cloud Accounts\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Persistence\",\n \"Privilege Escalation\",\n \"Initial Access\"\n ],\n \"mitre_attack_groups\": [\n \"APT33\"\n ]\n },\n \"baselines\": [\n {\n \"name\": \"Previously Seen EC2 Launches By User\",\n \"id\": \"6c767ac0-0906-4355-9a83-927f5ee7bdad\",\n \"version\": 1,\n \"date\": \"2018-03-15\",\n \"description\": \"This search builds a table of previously seen ARNs that have launched a EC2 instance.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"`cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Cryptomining\",\n \"Suspicious AWS EC2 Activities\"\n ],\n \"detections\": [\n \"EC2 Instance Started With Previously Unseen User\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"ec2_instance_started_with_previously_unseen_user_filter\"\n }\n ]\n }\n ]\n },\n {\n \"name\": \"AWS Network ACL Activity\",\n \"id\": \"2e8948a5-5239-406b-b56b-6c50ff268af4\",\n \"version\": 2,\n \"date\": \"2018-05-21\",\n \"description\": \"Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.\",\n \"narrative\": \"AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"type\": \"ESCU\",\n \"references\": [\n \"https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html\",\n \"https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/\"\n ],\n \"tags\": {\n \"analytics_story\": \"AWS Network ACL Activity\",\n \"usecase\": \"Security Monitoring\",\n \"category\": [\n \"Cloud Security\"\n ],\n \"mitre_attack_id\": [],\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"detections\": [\n {\n \"name\": \"AWS Network Access Control List Created with All Open Ports\",\n \"id\": \"ada0f478-84a8-4641-a3f1-d82362d6bd75\",\n \"version\": 1,\n \"date\": \"2017-01-10\",\n \"description\": \"The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail inputs.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` eventName=CreateNetworkAclEntry | mvexpand requestParameters | mvexpand responseElements | search requestParameters.portRange.from=1024 requestParameters.portRange.to=65535 requestParameters.ruleAction=allow | rename userIdentity.arn as arn | rename requestParameters.networkAclId as networkAclId | table _time aws_account_id src userName arn networkAclId requestParameters.* responseElements.* | `aws_network_access_control_list_created_with_all_open_ports_filter`\",\n \"known_false_positives\": \"It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Network ACL Activity\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 11\"\n ],\n \"nist\": [\n \"DE.DP\",\n \"DE.AE\"\n ],\n \"security_domain\": \"network\",\n \"asset_type\": \"AWS Instance\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"aws_network_access_control_list_created_with_all_open_ports_filter\"\n }\n ]\n },\n {\n \"name\": \"AWS Network Access Control List Deleted\",\n \"id\": \"ada0f478-84a8-4641-a3f1-d82362d6fd75\",\n \"version\": 1,\n \"date\": \"2017-01-10\",\n \"description\": \"Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` eventName=DeleteNetworkAcl|rename userIdentity.arn as arn | stats count min(_time) as firstTime max(_time) as lastTime values(errorMessage) values(errorCode) values(userAgent) values(userIdentity.*) by src userName arn eventName | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `aws_network_access_control_list_deleted_filter`\",\n \"known_false_positives\": \"It's possible that a user has legitimately deleted a network ACL.\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Network ACL Activity\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 11\"\n ],\n \"nist\": [\n \"DE.DP\",\n \"DE.AE\"\n ],\n \"security_domain\": \"network\",\n \"asset_type\": \"AWS Instance\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"aws_network_access_control_list_deleted_filter\"\n }\n ]\n },\n {\n \"name\": \"Detect Spike in blocked Outbound Traffic from your AWS\",\n \"id\": \"ada0f278-84a8-46w1-a3f1-w32372d4bd53\",\n \"version\": 1,\n \"date\": \"2018-05-07\",\n \"description\": \"This search will detect spike in blocked outbound network connections originating from within your AWS environment. It will also update the cache file that factors in the latest data.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow logs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the number of data points required to meet the definition of \\\"spike.\\\" The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the \\\"Baseline of Blocked Outbound Connection\\\" support search once to create a history of previously seen blocked outbound connections.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) [search `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | stats count as numberOfBlockedConnections by src_ip | inputlookup baseline_blocked_outbound_connections append=t | fields - latestCount | stats values(*) as * by src_ip | rename numberOfBlockedConnections as latestCount | eval newAvgBlockedConnections=avgBlockedConnections + (latestCount-avgBlockedConnections)/720 | eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections, 2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720)) | eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections), stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections | eval dataPointThreshold = 5, deviationThreshold = 3 | eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections) AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | table src_ip] | stats values(dest_ip) as \\\"Blocked Destination IPs\\\", values(interface_id) as \\\"resourceId\\\" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections by src_ip | `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter`\",\n \"known_false_positives\": \"The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Additionally, false positives may result when AWS administrators roll out policies enforcing network blocks, causing sudden increases in the number of blocked outbound connections.\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Network ACL Activity\",\n \"Suspicious AWS Traffic\",\n \"Command and Control\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\",\n \"Command and Control\"\n ],\n \"cis20\": [\n \"CIS 11\"\n ],\n \"nist\": [\n \"DE.AE\",\n \"DE.CM\",\n \"PR.AC\"\n ],\n \"security_domain\": \"network\",\n \"asset_type\": \"AWS Instance\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"baselines\": [\n {\n \"name\": \"Baseline of blocked outbound traffic from AWS\",\n \"id\": \"fc0edd96-ff2b-48b0-9f1f-63da3782fd63\",\n \"version\": 1,\n \"date\": \"2018-05-07\",\n \"description\": \"This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Network ACL Activity\",\n \"Command and Control\",\n \"Suspicious AWS Traffic\"\n ],\n \"detections\": [\n \"Detect Spike in blocked Outbound Traffic from your AWS\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudwatchlogs:vpcflow\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudwatchlogs_vpcflow\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"detect_spike_in_blocked_outbound_traffic_from_your_aws_filter\"\n }\n ]\n },\n {\n \"name\": \"Detect Spike in Network ACL Activity\",\n \"id\": \"ada0f478-84a8-4641-a1f1-e32372d4bd53\",\n \"version\": 1,\n \"date\": \"2018-05-21\",\n \"description\": \"This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the \\\"Baseline of Network ACL Activity by ARN\\\" support search once to create a lookup file of previously seen Network ACL Activity. To add or remove API event names related to network ACLs, edit the macro `network_acl_events`.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` `network_acl_events` [search `cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | stats count as apiCalls by arn | inputlookup network_acl_activity_baseline append=t | fields - latestCount | stats values(*) as * by arn | rename apiCalls as latestCount | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | eval dataPointThreshold = 15, deviationThreshold = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_network_acl_activity_filter`\",\n \"known_false_positives\": \"The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Please modify this according the your environment.\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Network ACL Activity\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 12\",\n \"CIS 11\"\n ],\n \"nist\": [\n \"DE.DP\",\n \"DE.CM\",\n \"PR.AC\"\n ],\n \"security_domain\": \"network\",\n \"asset_type\": \"AWS Instance\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"baselines\": [\n {\n \"name\": \"Baseline of Network ACL Activity by ARN\",\n \"id\": \"fc0edd96-ff2b-4810-9f1f-63da3783fd63\",\n \"version\": 1,\n \"date\": \"2018-05-21\",\n \"description\": \"This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Network ACL Activity\"\n ],\n \"detections\": [\n \"Detect Spike in Network ACL Activity\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"definition\": \"(eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)\",\n \"description\": \"This is a list of AWS event names that are associated with Network ACLs\",\n \"name\": \"network_acl_events\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"detect_spike_in_network_acl_activity_filter\"\n }\n ]\n }\n ]\n },\n {\n \"name\": \"AWS Security Hub Alerts\",\n \"id\": \"2f2f610a-d64d-48c2-b57c-96722b49ab5a\",\n \"version\": 1,\n \"date\": \"2020-08-04\",\n \"description\": \"This story is focused around detecting Security Hub alerts generated from AWS\",\n \"narrative\": \"AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"type\": \"ESCU\",\n \"references\": [\n \"https://aws.amazon.com/security-hub/features/\"\n ],\n \"tags\": {\n \"analytics_story\": \"AWS Security Hub Alerts\",\n \"usecase\": \"Security Monitoring\",\n \"category\": [\n \"Cloud Security\"\n ],\n \"mitre_attack_id\": [],\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"detections\": [\n {\n \"name\": \"Detect Spike in AWS Security Hub Alerts for EC2 Instance\",\n \"id\": \"2a9b80d3-6340-4345-b5ad-290bf5d0d222\",\n \"version\": 2,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`aws_securityhub_firehose` \\\"findings{}.Resources{}.Type\\\"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?Add Prohibited Processes to Enterprise Security.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `prohibited_softwares` | `prohibited_software_on_endpoint_filter`\",\n \"known_false_positives\": \"None identified\",\n \"tags\": {\n \"analytics_story\": [\n \"Monitor for Unauthorized Software\",\n \"Emotet Malware DHS Report TA18-201A \",\n \"SamSam Ransomware\"\n ],\n \"kill_chain_phases\": [\n \"Installation\",\n \"Command and Control\",\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 2\"\n ],\n \"nist\": [\n \"ID.AM\",\n \"PR.DS\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"baselines\": [\n {\n \"name\": \"Add Prohibited Processes to Enterprise Security\",\n \"id\": \"251930a5-1451-4428-bb13-eed5775be0ce\",\n \"version\": 1,\n \"date\": \"2017-09-15\",\n \"description\": \"This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints.\",\n \"how_to_implement\": \"This search should be run on each new install of ESCU.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| inputlookup interesting_processes_lookup | search note!=ESCU* | inputlookup append=T prohibitedProcesses_lookup | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup interesting_processes_lookup | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"Emotet Malware DHS Report TA18-201A \",\n \"Monitor for Unauthorized Software\",\n \"SamSam Ransomware\"\n ],\n \"detections\": [\n \"Prohibited Software On Endpoint\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"lookup interesting_processes_lookup app as process_name OUTPUT is_prohibited | search is_prohibited=True\",\n \"description\": \"This macro limits the output to process_names that have been marked as prohibited\",\n \"name\": \"prohibited_softwares\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"prohibited_software_on_endpoint_filter\"\n }\n ]\n },\n {\n \"name\": \"Registry Keys Used For Persistence\",\n \"id\": \"f5f6af30-7aa7-4295-bfe9-07fe87c01a4b\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"The search looks for modifications to registry keys that can be used to launch an application or service at system startup.\",\n \"how_to_implement\": \"To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\\\\\\\run* OR Registry.registry_path=*currentVersion\\\\\\\\Windows\\\\\\\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\\\\\\\Winlogon\\\\\\\\Shell* OR Registry.registry_path=*CurrentVersion\\\\\\\\Winlogon\\\\\\\\Userinit* OR Registry.registry_path=*CurrentVersion\\\\\\\\Winlogon\\\\\\\\VmApplet* OR Registry.registry_path=*currentversion\\\\\\\\policies\\\\\\\\explorer\\\\\\\\run* OR Registry.registry_path=*currentversion\\\\\\\\runservices* OR Registry.registry_path=*\\\\\\\\CurrentControlSet\\\\\\\\Control\\\\\\\\Lsa\\\\\\\\* OR Registry.registry_path=\\\"*Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\Image File Execution Options*\\\" OR Registry.registry_path=HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Netsh\\\\\\\\*) by Registry.dest , Registry.status, Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`\",\n \"known_false_positives\": \"There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task.\",\n \"tags\": {\n \"analytics_story\": [\n \"Suspicious Windows Registry Activities\",\n \"Suspicious MSHTA Activity\",\n \"DHS Report TA18-074A\",\n \"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns\",\n \"Ransomware\",\n \"Windows Persistence Techniques\",\n \"Emotet Malware DHS Report TA18-201A \"\n ],\n \"mitre_attack_id\": [\n \"T1547.001\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\",\n \"DE.AE\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Registry Run Keys / Startup Folder\"\n ],\n \"mitre_attack_tactics\": [\n \"Persistence\",\n \"Privilege Escalation\"\n ],\n \"mitre_attack_groups\": [\n \"Rocke\",\n \"Tropic Trooper\",\n \"Gamaredon Group\",\n \"Sharpshooter\",\n \"Molerats\",\n \"Silence\",\n \"RTM\",\n \"Inception\",\n \"APT41\",\n \"Machete\",\n \"Kimsuky\",\n \"APT33\",\n \"APT39\",\n \"APT32\",\n \"APT18\",\n \"Turla\",\n \"Dark Caracal\",\n \"Cobalt Group\",\n \"Honeybee\",\n \"Threat Group-3390\",\n \"Dragonfly 2.0\",\n \"Gorgon Group\",\n \"Ke3chang\",\n \"APT19\",\n \"Leviathan\",\n \"MuddyWater\",\n \"APT37\",\n \"BRONZE BUTLER\",\n \"Magic Hound\",\n \"APT3\",\n \"FIN10\",\n \"FIN7\",\n \"Patchwork\",\n \"FIN6\",\n \"Lazarus Group\",\n \"Putter Panda\",\n \"APT29\",\n \"Darkhotel\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"registry_keys_used_for_persistence_filter\"\n }\n ]\n },\n {\n \"name\": \"SMB Traffic Spike\",\n \"id\": \"7f5fb3e1-4209-4914-90db-0ec21b936378\",\n \"version\": 3,\n \"date\": \"2020-07-22\",\n \"description\": \"This search looks for spikes in the number of Server Message Block (SMB) traffic connections.\",\n \"how_to_implement\": \"This search requires you to be ingesting your network traffic logs and populating the `Network_Traffic` data model.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=1h, All_Traffic.src | `drop_dm_object_name(\\\"All_Traffic\\\")` | eventstats max(_time) as maxtime | stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, \\\"-70m@m\\\"), count, null))) as count avg(eval(if(_timeAdd Prohibited Processes to Enterprise Security.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `prohibited_softwares` | `prohibited_software_on_endpoint_filter`\",\n \"known_false_positives\": \"None identified\",\n \"tags\": {\n \"analytics_story\": [\n \"Monitor for Unauthorized Software\",\n \"Emotet Malware DHS Report TA18-201A \",\n \"SamSam Ransomware\"\n ],\n \"kill_chain_phases\": [\n \"Installation\",\n \"Command and Control\",\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 2\"\n ],\n \"nist\": [\n \"ID.AM\",\n \"PR.DS\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"baselines\": [\n {\n \"name\": \"Add Prohibited Processes to Enterprise Security\",\n \"id\": \"251930a5-1451-4428-bb13-eed5775be0ce\",\n \"version\": 1,\n \"date\": \"2017-09-15\",\n \"description\": \"This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints.\",\n \"how_to_implement\": \"This search should be run on each new install of ESCU.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| inputlookup interesting_processes_lookup | search note!=ESCU* | inputlookup append=T prohibitedProcesses_lookup | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup interesting_processes_lookup | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"Emotet Malware DHS Report TA18-201A \",\n \"Monitor for Unauthorized Software\",\n \"SamSam Ransomware\"\n ],\n \"detections\": [\n \"Prohibited Software On Endpoint\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"lookup interesting_processes_lookup app as process_name OUTPUT is_prohibited | search is_prohibited=True\",\n \"description\": \"This macro limits the output to process_names that have been marked as prohibited\",\n \"name\": \"prohibited_softwares\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"prohibited_software_on_endpoint_filter\"\n }\n ]\n }\n ]\n },\n {\n \"name\": \"Monitor for Updates\",\n \"id\": \"9ef8d677-7b52-4213-a038-99cfc7acc2d8\",\n \"version\": 1,\n \"date\": \"2017-09-15\",\n \"description\": \"Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.\",\n \"narrative\": \"It is a common best practice to ensure that endpoints are being patched and updated in a timely manner, in order to reduce the risk of compromise via a publicly disclosed vulnerability. Timely application of updates/patches is important to eliminate known vulnerabilities that may be exploited by various threat actors.\\\\\\nSearches in this analytic story are designed to help analysts monitor endpoints for system patches and/or updates. This helps analysts identify any systems that are not successfully updated in a timely matter.\\\\\\nMicrosoft releases updates for Windows systems on a monthly cadence. They should be installed as soon as possible after following internal testing and validation procedures. Patches and updates for other systems or applications are typically released as needed.\",\n \"author\": \"Rico Valdez, Splunk\",\n \"type\": \"ESCU\",\n \"references\": [\n \"https://learn.cisecurity.org/20-controls-download\"\n ],\n \"tags\": {\n \"analytics_story\": \"Monitor for Updates\",\n \"usecase\": \"Compliance\",\n \"category\": [\n \"Best Practices\"\n ],\n \"mitre_attack_id\": [],\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"detections\": [\n {\n \"name\": \"No Windows Updates in a time frame\",\n \"id\": \"1a77c08c-2f56-409c-a2d3-7d64617edd4f\",\n \"version\": 1,\n \"date\": \"2017-09-15\",\n \"description\": \"This search looks for Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. Windows updates are typically released monthly and applied shortly thereafter. An endpoint that has not successfully applied an update in this time frame indicates the endpoint is not regularly being patched for some reason.\",\n \"how_to_implement\": \"To successfully implement this search, it requires that the 'Update' data model is being populated. This can be accomplished by ingesting Windows events or the Windows Update log via a universal forwarder on the Windows endpoints you wish to monitor. The Windows add-on should be also be installed and configured to properly parse Windows events in Splunk. There may be other data sources which can populate this data model, including vulnerability management systems.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` max(_time) as lastTime from datamodel=Updates where Updates.status=Installed Updates.vendor_product=\\\"Microsoft Windows\\\" by Updates.dest Updates.status Updates.vendor_product | rename Updates.dest as Host | rename Updates.status as \\\"Update Status\\\" | rename Updates.vendor_product as Product | eval isOutlier=if(lastTime <= relative_time(now(), \\\"-60d@d\\\"), 1, 0) | `security_content_ctime(lastTime)` | search isOutlier=1 | rename lastTime as \\\"Last Update Time\\\", | table Host, \\\"Update Status\\\", Product, \\\"Last Update Time\\\" | `no_windows_updates_in_a_time_frame_filter`\",\n \"known_false_positives\": \"None identified\",\n \"tags\": {\n \"analytics_story\": [\n \"Monitor for Updates\"\n ],\n \"cis20\": [\n \"CIS 18\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"PR.MA\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"no_windows_updates_in_a_time_frame_filter\"\n }\n ]\n }\n ]\n },\n {\n \"name\": \"Netsh Abuse\",\n \"id\": \"2b1800dd-92f9-47ec-a981-fdf1351e5f65\",\n \"version\": 1,\n \"date\": \"2017-01-05\",\n \"description\": \"Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.\",\n \"narrative\": \"It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\\\\\\nTo get started, run the detection search to identify parent processes of `netsh.exe`.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"type\": \"ESCU\",\n \"references\": [\n \"https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)\",\n \"https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html\",\n \"http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html\"\n ],\n \"tags\": {\n \"analytics_story\": \"Netsh Abuse\",\n \"usecase\": \"Advanced Threat Detection\",\n \"category\": [\n \"Abuse\"\n ],\n \"mitre_attack_id\": [\n \"T1562.004\",\n \"T1059.003\",\n \"T1059.001\"\n ],\n \"mitre_attack_technique\": [\n \"Windows Command Shell\",\n \"PowerShell\",\n \"Disable or Modify System Firewall\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\",\n \"Execution\"\n ],\n \"mitre_attack_groups\": [\n \"MuddyWater\",\n \"Dragonfly 2.0\",\n \"Soft Cell\",\n \"FIN7\",\n \"Lazarus Group\",\n \"Rocke\",\n \"APT41\",\n \"BRONZE BUTLER\",\n \"Honeybee\",\n \"Gamaredon Group\",\n \"Frankenstein\",\n \"TA459\",\n \"DarkHydrus\",\n \"Cobalt Group\",\n \"Threat Group-3390\",\n \"FIN10\",\n \"APT18\",\n \"APT32\",\n \"Tropic Trooper\",\n \"TEMP.Veles\",\n \"Patchwork\",\n \"APT28\",\n \"Deep Panda\",\n \"Turla\",\n \"Ke3chang\",\n \"Rancor\",\n \"CopyKittens\",\n \"FIN8\",\n \"APT38\",\n \"Gallmaker\",\n \"APT29\",\n \"Sowbug\",\n \"Silence\",\n \"APT19\",\n \"Molerats\",\n \"APT37\",\n \"menuPass\",\n \"DarkVishnya\",\n \"Blue Mockingbird\",\n \"Suckfly\",\n \"Poseidon Group\",\n \"Stealth Falcon\",\n \"APT39\",\n \"Gorgon Group\",\n \"Magic Hound\",\n \"admin@338\",\n \"Inception\",\n \"Kimsuky\",\n \"Dark Caracal\",\n \"Carbanak\",\n \"Thrip\",\n \"APT3\",\n \"Darkhotel\",\n \"Wizard Spider\",\n \"WIRTE\",\n \"Leviathan\",\n \"OilRig\",\n \"FIN6\",\n \"Threat Group-1314\",\n \"TA505\",\n \"APT33\",\n \"APT1\"\n ]\n },\n \"detections\": [\n {\n \"name\": \"Processes created by netsh\",\n \"id\": \"b89919ed-fe5f-492c-b139-95dbb162041e\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for processes launching netsh.exe to execute various commands via the netsh command-line utility. Netsh.exe is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper .dll when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe that are executing commands via the command line.\",\n \"how_to_implement\": \"To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process=\\\"*C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\netsh.exe*\\\" AND Processes.process_path!=\\\"C:\\\\\\\\Program Files\\\\\\\\rempl\\\\\\\\sedlauncher.exe\\\") by Processes.user Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name | `drop_dm_object_name(\\\"Processes\\\")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `processes_created_by_netsh_filter`\",\n \"known_false_positives\": \"It is unusual for netsh.exe to have any child processes in most environments. It makes sense to investigate the child process and verify whether the process spawned is legitimate. We explicitely exclude \\\"C:\\\\Program Files\\\\rempl\\\\sedlauncher.exe\\\" process path since it is a legitimate process by Mircosoft.\",\n \"tags\": {\n \"analytics_story\": [\n \"Netsh Abuse\"\n ],\n \"mitre_attack_id\": [\n \"T1059.001\",\n \"T1059.003\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"PowerShell\",\n \"Windows Command Shell\"\n ],\n \"mitre_attack_tactics\": [\n \"Execution\",\n \"Execution\"\n ],\n \"mitre_attack_groups\": [\n \"Blue Mockingbird\",\n \"APT39\",\n \"DarkVishnya\",\n \"Molerats\",\n \"Wizard Spider\",\n \"Frankenstein\",\n \"Inception\",\n \"Silence\",\n \"APT41\",\n \"Kimsuky\",\n \"Soft Cell\",\n \"TA505\",\n \"WIRTE\",\n \"TEMP.Veles\",\n \"APT33\",\n \"Gallmaker\",\n \"Turla\",\n \"APT19\",\n \"DarkHydrus\",\n \"APT28\",\n \"Thrip\",\n \"Gorgon Group\",\n \"Cobalt Group\",\n \"Dragonfly 2.0\",\n \"Leviathan\",\n \"TA459\",\n \"FIN8\",\n \"MuddyWater\",\n \"Magic Hound\",\n \"OilRig\",\n \"BRONZE BUTLER\",\n \"CopyKittens\",\n \"APT32\",\n \"FIN7\",\n \"FIN10\",\n \"Threat Group-3390\",\n \"menuPass\",\n \"Patchwork\",\n \"Stealth Falcon\",\n \"FIN6\",\n \"Poseidon Group\",\n \"APT3\",\n \"APT29\",\n \"Deep Panda\",\n \"TA505\",\n \"Blue Mockingbird\",\n \"Tropic Trooper\",\n \"Frankenstein\",\n \"OilRig\",\n \"Lazarus Group\",\n \"Honeybee\",\n \"Cobalt Group\",\n \"FIN7\",\n \"APT41\",\n \"Soft Cell\",\n \"Turla\",\n \"Silence\",\n \"APT32\",\n \"APT39\",\n \"Darkhotel\",\n \"MuddyWater\",\n \"APT18\",\n \"APT38\",\n \"Dark Caracal\",\n \"Gorgon Group\",\n \"Dragonfly 2.0\",\n \"Rancor\",\n \"Ke3chang\",\n \"APT37\",\n \"Leviathan\",\n \"FIN8\",\n \"APT28\",\n \"Magic Hound\",\n \"Sowbug\",\n \"BRONZE BUTLER\",\n \"FIN10\",\n \"Threat Group-3390\",\n \"menuPass\",\n \"Gamaredon Group\",\n \"Suckfly\",\n \"Patchwork\",\n \"Threat Group-1314\",\n \"APT3\",\n \"admin@338\",\n \"APT1\"\n ]\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"processes_created_by_netsh_filter\"\n }\n ]\n },\n {\n \"name\": \"Processes launching netsh\",\n \"id\": \"b89919ed-fe5f-492c-b139-95dbb162040e\",\n \"version\": 3,\n \"date\": \"2020-07-10\",\n \"description\": \"This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line.\",\n \"how_to_implement\": \"To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Josef Kuepker, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count values(Processes.process) AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.user Processes.dest |`drop_dm_object_name(\\\"Processes\\\")` |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`processes_launching_netsh_filter`\",\n \"known_false_positives\": \"Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands.\",\n \"tags\": {\n \"analytics_story\": [\n \"Netsh Abuse\",\n \"Disabling Security Tools\",\n \"DHS Report TA18-074A\"\n ],\n \"mitre_attack_id\": [\n \"T1562.004\"\n ],\n \"kill_chain_phases\": [\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"Disable or Modify System Firewall\"\n ],\n \"mitre_attack_tactics\": [\n \"Defense Evasion\"\n ],\n \"mitre_attack_groups\": [\n \"Rocke\",\n \"Lazarus Group\",\n \"Kimsuky\",\n \"Dragonfly 2.0\",\n \"Carbanak\"\n ]\n },\n \"baselines\": [\n {\n \"name\": \"Baseline of SMB Traffic - MLTK\",\n \"id\": \"df98763b-0b08-4281-8ef9-08db7ac572a9\",\n \"version\": 1,\n \"date\": \"2019-05-08\",\n \"description\": \"This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.\",\n \"how_to_implement\": \"You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding \\\"src\\\" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.\",\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, \\\"%H\\\") | eval DayOfWeek=strftime(_time, \\\"%A\\\") | `drop_dm_object_name(\\\"All_Traffic\\\")` | fit DensityFunction count by \\\"HourOfDay,DayOfWeek\\\" into smb_pdfmodel\",\n \"tags\": {\n \"analytics_story\": [\n \"DHS Report TA18-074A\",\n \"Disabling Security Tools\",\n \"Emotet Malware DHS Report TA18-201A \",\n \"Hidden Cobra Malware\",\n \"Netsh Abuse\",\n \"Ransomware\"\n ],\n \"detections\": [\n \"Processes launching netsh\",\n \"SMB Traffic Spike - MLTK\"\n ]\n }\n },\n {\n \"name\": \"Previously seen command line arguments\",\n \"id\": \"56059acf-50fe-4f60-98d1-b75b51b5c2f3\",\n \"version\": 2,\n \"date\": \"2019-03-01\",\n \"description\": \"This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process=\\\"* /c *\\\" by Processes.process | `drop_dm_object_name(Processes)`\",\n \"tags\": {\n \"analytics_story\": [\n \"DHS Report TA18-074A\",\n \"Disabling Security Tools\",\n \"Hidden Cobra Malware\",\n \"Netsh Abuse\",\n \"Orangeworm Attack Group\",\n \"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns\",\n \"Suspicious Command-Line Executions\",\n \"Suspicious MSHTA Activity\"\n ],\n \"detections\": [\n \"Detect Prohibited Applications Spawning cmd.exe\",\n \"Processes launching netsh\",\n \"First time seen command line argument\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"processes_launching_netsh_filter\"\n }\n ]\n }\n ]\n },\n {\n \"name\": \"Orangeworm Attack Group\",\n \"id\": \"bb9f5ed2-916e-4364-bb6d-97c370efcf52\",\n \"version\": 2,\n \"date\": \"2020-01-22\",\n \"description\": \"Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.\",\n \"narrative\": \"In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\\\\\\nAwareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\\\\\\nAlthough the group's motivation is unknown, its goal may be stealing patient information to sell on the black market. Another possible explanation is corporate espionage. \\\\\\nHealthcare may be a promising target, because it is notoriously behind in technology, often using older operating systems and neglecting to patch computers. Even so, the group was able to evade detection for a full three years. Sources say that the malware spread quickly within the target networks, infecting computers used to control medical devices, such as MRI and X-ray machines.\\\\\\nThis Analytic Story is designed to help you detect and investigate suspicious activities that may be indicative of an Orangeworm attack. One detection search looks for command-line arguments. Another monitors for uses of sc.exe, a non-essential Windows file that can manipulate Windows services. One of the investigative searches helps you get more information on web hosts that you suspect have been compromised.\",\n \"author\": \"David Dorsey, Splunk\",\n \"type\": \"ESCU\",\n \"references\": [\n \"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia\",\n \"https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/\"\n ],\n \"tags\": {\n \"analytics_story\": \"Orangeworm Attack Group\",\n \"usecase\": \"Advanced Threat Detection\",\n \"category\": [\n \"Malware\"\n ],\n \"mitre_attack_id\": [\n \"T1059.003\",\n \"T1569.002\",\n \"T1059.001\",\n \"T1543.003\"\n ],\n \"mitre_attack_technique\": [\n \"Windows Command Shell\",\n \"PowerShell\",\n \"Windows Service\",\n \"Service Execution\"\n ],\n \"mitre_attack_tactics\": [\n \"Privilege Escalation\",\n \"Execution\",\n \"Persistence\"\n ],\n \"mitre_attack_groups\": [\n \"MuddyWater\",\n \"Dragonfly 2.0\",\n \"Soft Cell\",\n \"FIN7\",\n \"Lazarus Group\",\n \"APT41\",\n \"BRONZE BUTLER\",\n \"Honeybee\",\n \"Gamaredon Group\",\n \"Frankenstein\",\n \"TA459\",\n \"DarkHydrus\",\n \"Cobalt Group\",\n \"Threat Group-3390\",\n \"FIN10\",\n \"APT18\",\n \"APT32\",\n \"Tropic Trooper\",\n \"TEMP.Veles\",\n \"Patchwork\",\n \"APT28\",\n \"Deep Panda\",\n \"Turla\",\n \"Ke3chang\",\n \"Rancor\",\n \"CopyKittens\",\n \"FIN8\",\n \"APT38\",\n \"Gallmaker\",\n \"APT29\",\n \"Sowbug\",\n \"Silence\",\n \"APT19\",\n \"Molerats\",\n \"APT37\",\n \"menuPass\",\n \"DarkVishnya\",\n \"Blue Mockingbird\",\n \"Suckfly\",\n \"Poseidon Group\",\n \"Stealth Falcon\",\n \"APT39\",\n \"Gorgon Group\",\n \"Magic Hound\",\n \"admin@338\",\n \"Inception\",\n \"Kimsuky\",\n \"Dark Caracal\",\n \"Carbanak\",\n \"Thrip\",\n \"APT3\",\n \"Darkhotel\",\n \"Wizard Spider\",\n \"WIRTE\",\n \"Leviathan\",\n \"OilRig\",\n \"FIN6\",\n \"Threat Group-1314\",\n \"TA505\",\n \"APT33\",\n \"APT1\"\n ]\n },\n \"detections\": [\n {\n \"name\": \"First time seen command line argument\",\n \"id\": \"9be56c82-b1cc-4318-87eb-q138afaaqa39\",\n \"version\": 5,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model. Please make sure you run the support search \\\"Previously seen command line arguments,\\\"—which creates a lookup file called `previously_seen_cmd_line_arguments.csv`—a historical baseline of all command-line arguments. You must also validate this list. For the search to do accurate calculation, ensure the search scheduling is the same value as the `relative_time` evaluation function.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = \\\"* /c *\\\" by Processes.process Processes.process_name Processes.parent_process_name Processes.dest| `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search [| tstats `security_content_summariesonly` earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = \\\"* /c *\\\" by Processes.process | `drop_dm_object_name(Processes)` | inputlookup append=t previously_seen_cmd_line_arguments | stats min(firstTime) as firstTime, max(lastTime) as lastTime by process | outputlookup previously_seen_cmd_line_arguments | eval newCmdLineArgument=if(firstTime >= relative_time(now(), \\\"-70m@m\\\"), 1, 0) | where newCmdLineArgument=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table process] | `first_time_seen_command_line_argument_filter` \",\n \"known_false_positives\": \"Legitimate programs can also use command-line arguments to execute. Please verify the command-line arguments to check what command/program is being executed. We recommend customizing the `first_time_seen_cmd_line_filter` macro to exclude legitimate parent_process_name\",\n \"tags\": {\n \"analytics_story\": [\n \"DHS Report TA18-074A\",\n \"Suspicious Command-Line Executions\",\n \"Orangeworm Attack Group\",\n \"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns\",\n \"Hidden Cobra Malware\"\n ],\n \"mitre_attack_id\": [\n \"T1059.001\",\n \"T1059.003\"\n ],\n \"kill_chain_phases\": [\n \"Command and Control\",\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 3\",\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\",\n \"PR.IP\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [\n \"PowerShell\",\n \"Windows Command Shell\"\n ],\n \"mitre_attack_tactics\": [\n \"Execution\",\n \"Execution\"\n ],\n \"mitre_attack_groups\": [\n \"Blue Mockingbird\",\n \"APT39\",\n \"DarkVishnya\",\n \"Molerats\",\n \"Wizard Spider\",\n \"Frankenstein\",\n \"Inception\",\n \"Silence\",\n \"APT41\",\n \"Kimsuky\",\n \"Soft Cell\",\n \"TA505\",\n \"WIRTE\",\n \"TEMP.Veles\",\n \"APT33\",\n \"Gallmaker\",\n \"Turla\",\n \"APT19\",\n \"DarkHydrus\",\n \"APT28\",\n \"Thrip\",\n \"Gorgon Group\",\n \"Cobalt Group\",\n \"Dragonfly 2.0\",\n \"Leviathan\",\n \"TA459\",\n \"FIN8\",\n \"MuddyWater\",\n \"Magic Hound\",\n \"OilRig\",\n \"BRONZE BUTLER\",\n \"CopyKittens\",\n \"APT32\",\n \"FIN7\",\n \"FIN10\",\n \"Threat Group-3390\",\n \"menuPass\",\n \"Patchwork\",\n \"Stealth Falcon\",\n \"FIN6\",\n \"Poseidon Group\",\n \"APT3\",\n \"APT29\",\n \"Deep Panda\",\n \"TA505\",\n \"Blue Mockingbird\",\n \"Tropic Trooper\",\n \"Frankenstein\",\n \"OilRig\",\n \"Lazarus Group\",\n \"Honeybee\",\n \"Cobalt Group\",\n \"FIN7\",\n \"APT41\",\n \"Soft Cell\",\n \"Turla\",\n \"Silence\",\n \"APT32\",\n \"APT39\",\n \"Darkhotel\",\n \"MuddyWater\",\n \"APT18\",\n \"APT38\",\n \"Dark Caracal\",\n \"Gorgon Group\",\n \"Dragonfly 2.0\",\n \"Rancor\",\n \"Ke3chang\",\n \"APT37\",\n \"Leviathan\",\n \"FIN8\",\n \"APT28\",\n \"Magic Hound\",\n \"Sowbug\",\n \"BRONZE BUTLER\",\n \"FIN10\",\n \"Threat Group-3390\",\n \"menuPass\",\n \"Gamaredon Group\",\n \"Suckfly\",\n \"Patchwork\",\n \"Threat Group-1314\",\n \"APT3\",\n \"admin@338\",\n \"APT1\"\n ]\n },\n \"baselines\": [\n {\n \"name\": \"Previously seen command line arguments\",\n \"id\": \"56059acf-50fe-4f60-98d1-b75b51b5c2f3\",\n \"version\": 2,\n \"date\": \"2019-03-01\",\n \"description\": \"This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days.\",\n \"how_to_implement\": \"You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the \\\"process\\\" field in the Endpoint data model.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process=\\\"* /c *\\\" by Processes.process | `drop_dm_object_name(Processes)`\",\n \"tags\": {\n \"analytics_story\": [\n \"DHS Report TA18-074A\",\n \"Disabling Security Tools\",\n \"Hidden Cobra Malware\",\n \"Netsh Abuse\",\n \"Orangeworm Attack Group\",\n \"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns\",\n \"Suspicious Command-Line Executions\",\n \"Suspicious MSHTA Activity\"\n ],\n \"detections\": [\n \"Detect Prohibited Applications Spawning cmd.exe\",\n \"Processes launching netsh\",\n \"First time seen command line argument\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"first_time_seen_command_line_argument_filter\"\n }\n ]\n },\n {\n \"name\": \"First Time Seen Running Windows Service\",\n \"id\": \"823136f2-d755-4b6d-ae04-372b486a5808\",\n \"version\": 4,\n \"date\": \"2020-07-21\",\n \"description\": \"This search looks for the first and last time a Windows service is seen running in your environment. This table is then cached.\",\n \"how_to_implement\": \"While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows system event logs in order for this search to execute successfully. You should run the baseline search `Previously Seen Running Windows Services - Initial` to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search `Previously Seen Running Windows Services - Update` to keep this table up to date and to age out old Windows Services. Please update the `previously_seen_windows_service_window` macro to adjust the time window. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"`wineventlog_system` EventCode=7036 | rex field=Message \\\"The (?Add Prohibited Processes to Enterprise Security.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `prohibited_softwares` | `prohibited_software_on_endpoint_filter`\",\n \"known_false_positives\": \"None identified\",\n \"tags\": {\n \"analytics_story\": [\n \"Monitor for Unauthorized Software\",\n \"Emotet Malware DHS Report TA18-201A \",\n \"SamSam Ransomware\"\n ],\n \"kill_chain_phases\": [\n \"Installation\",\n \"Command and Control\",\n \"Actions on Objectives\"\n ],\n \"cis20\": [\n \"CIS 2\"\n ],\n \"nist\": [\n \"ID.AM\",\n \"PR.DS\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"baselines\": [\n {\n \"name\": \"Add Prohibited Processes to Enterprise Security\",\n \"id\": \"251930a5-1451-4428-bb13-eed5775be0ce\",\n \"version\": 1,\n \"date\": \"2017-09-15\",\n \"description\": \"This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints.\",\n \"how_to_implement\": \"This search should be run on each new install of ESCU.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| inputlookup interesting_processes_lookup | search note!=ESCU* | inputlookup append=T prohibitedProcesses_lookup | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup interesting_processes_lookup | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"Emotet Malware DHS Report TA18-201A \",\n \"Monitor for Unauthorized Software\",\n \"SamSam Ransomware\"\n ],\n \"detections\": [\n \"Prohibited Software On Endpoint\"\n ]\n }\n }\n ],\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"lookup interesting_processes_lookup app as process_name OUTPUT is_prohibited | search is_prohibited=True\",\n \"description\": \"This macro limits the output to process_names that have been marked as prohibited\",\n \"name\": \"prohibited_softwares\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"prohibited_software_on_endpoint_filter\"\n }\n ]\n },\n {\n \"name\": \"Samsam Test File Write\",\n \"id\": \"69c12d59-d951-431e-ab77-ec426b8d65e6\",\n \"version\": 1,\n \"date\": \"2018-12-14\",\n \"description\": \"The search looks for a file named \\\"test.txt\\\" written to the windows system directory tree, which is consistent with Samsam propagation.\",\n \"how_to_implement\": \"You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name from datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\\\\\\\windows\\\\\\\\system32\\\\\\\\test.txt by Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `samsam_test_file_write_filter`\",\n \"known_false_positives\": \"No false positives have been identified.\",\n \"tags\": {\n \"analytics_story\": [\n \"SamSam Ransomware\"\n ],\n \"kill_chain_phases\": [\n \"Delivery\"\n ],\n \"cis20\": [\n \"CIS 8\"\n ],\n \"nist\": [\n \"PR.PT\",\n \"DE.CM\"\n ],\n \"security_domain\": \"endpoint\",\n \"asset_type\": \"Endpoint\",\n \"mitre_attack_technique\": [],\n \"mitre_attack_tactics\": [],\n \"mitre_attack_groups\": []\n },\n \"macros\": [\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Update this macro to limit the output results to filter out false positives. \",\n \"name\": \"samsam_test_file_write_filter\"\n }\n ]\n },\n {\n \"name\": \"Spike in File Writes\",\n \"id\": \"fdb0f805-74e4-4539-8c00-618927333aae\",\n \"version\": 3,\n \"date\": \"2020-03-16\",\n \"description\": \"The search looks for a sharp increase in the number of files written to a particular host\",\n \"how_to_implement\": \"In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response products, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system.\",\n \"type\": \"ESCU\",\n \"references\": [],\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.action=created by _time span=1h, Filesystem.dest | `drop_dm_object_name(Filesystem)` | eventstats max(_time) as maxtime | stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, \\\"-1d@d\\\"), count, null))) as \\\"count\\\" avg(eval(if(_timeanalystic stories endpoint
\n","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"db51e0cf-4b26-4be5-bc02-2afc2e64d3d7"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"92e6132e-1f1e-4c08-949d-6bfe13812777"}}],"_postman_id":"309c583a-ebc3-4617-8740-70f2b5e8342e"},{"name":"baselines","item":[{"name":"/baselines","id":"20271b65-c534-46a5-855b-238051ce786b","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"GET","header":[],"url":"https://content.splunkresearch.com/baselines","description":"list all baselines
\n","urlObject":{"path":["baselines"],"host":["https://content.splunkresearch.com"],"query":[],"variable":[]}},"response":[{"id":"93161784-5dfd-459a-b9d3-5ec4dd9c25dc","name":"/baselines","originalRequest":{"method":"GET","header":[],"url":"https://content.splunkresearch.com/baselines"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Date","value":"Thu, 05 Nov 2020 08:25:46 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Content-Length","value":"54401"},{"key":"Connection","value":"keep-alive"},{"key":"x-amzn-RequestId","value":"06c2a377-eebf-4686-a8a4-4c93dde55a56"},{"key":"Access-Control-Allow-Origin","value":"*"},{"key":"Access-Control-Allow-Headers","value":"Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key"},{"key":"x-amz-apigw-id","value":"VhmJfG2lvHcFV8A="},{"key":"X-Amzn-Trace-Id","value":"Root=1-5fa3b709-6558f01b7908e0f563acc05a;Sampled=0"}],"cookie":[],"responseTime":null,"body":"{\n \"baselines\": [\n {\n \"name\": \"Add Prohibited Processes to Enterprise Security\",\n \"id\": \"251930a5-1451-4428-bb13-eed5775be0ce\",\n \"version\": 1,\n \"date\": \"2017-09-15\",\n \"description\": \"This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints.\",\n \"how_to_implement\": \"This search should be run on each new install of ESCU.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| inputlookup interesting_processes_lookup | search note!=ESCU* | inputlookup append=T prohibitedProcesses_lookup | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup interesting_processes_lookup | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"Emotet Malware DHS Report TA18-201A \",\n \"Monitor for Unauthorized Software\",\n \"SamSam Ransomware\"\n ],\n \"detections\": [\n \"Prohibited Software On Endpoint\"\n ]\n }\n },\n {\n \"name\": \"Baseline of API Calls per User ARN\",\n \"id\": \"fc0edc96-ff2b-48b0-9f6f-63da3783fd63\",\n \"version\": 1,\n \"date\": \"2018-04-09\",\n \"description\": \"This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"`cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS User Monitoring\"\n ],\n \"detections\": [\n \"Detect Spike in AWS API Activity\"\n ]\n }\n },\n {\n \"name\": \"Baseline of blocked outbound traffic from AWS\",\n \"id\": \"fc0edd96-ff2b-48b0-9f1f-63da3782fd63\",\n \"version\": 1,\n \"date\": \"2018-05-07\",\n \"description\": \"This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Network ACL Activity\",\n \"Command and Control\",\n \"Suspicious AWS Traffic\"\n ],\n \"detections\": [\n \"Detect Spike in blocked Outbound Traffic from your AWS\"\n ]\n }\n },\n {\n \"name\": \"Baseline of Command Line Length - MLTK\",\n \"id\": \"d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459\",\n \"version\": 1,\n \"date\": \"2019-05-08\",\n \"description\": \"This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line.\",\n \"how_to_implement\": \"You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.\",\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel\",\n \"tags\": {\n \"analytics_story\": [\n \"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns\",\n \"Ransomware\",\n \"Suspicious Command-Line Executions\",\n \"Suspicious MSHTA Activity\",\n \"Unusual Processes\"\n ],\n \"detections\": [\n \"Detect Prohibited Applications Spawning cmd.exe\",\n \"Unusually Long Command Line - MLTK\"\n ]\n }\n },\n {\n \"name\": \"Baseline of DNS Query Length - MLTK\",\n \"id\": \"c914844c-0ff5-4efc-8d44-c063443129ba\",\n \"version\": 1,\n \"date\": \"2019-05-08\",\n \"description\": \"This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query.\",\n \"how_to_implement\": \"To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.\",\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name(\\\"DNS\\\")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel\",\n \"tags\": {\n \"analytics_story\": [\n \"Command and Control\",\n \"Hidden Cobra Malware\",\n \"Suspicious DNS Traffic\"\n ],\n \"detections\": [\n \"DNS Query Length Outliers - MLTK\"\n ]\n }\n },\n {\n \"name\": \"Baseline of Excessive AWS Instances Launched by User - MLTK\",\n \"id\": \"fa5634df-fb05-4b4b-aba0-6115138bb1ba\",\n \"version\": 1,\n \"date\": \"2019-11-14\",\n \"description\": \"This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\\\\\\nIn addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\\\\\\nMore information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.\",\n \"author\": \"Jason Brewer, Splunk\",\n \"search\": \"`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_launched by _time src_user | fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1\",\n \"tags\": {\n \"analytics_story\": [\n \"Cloud Cryptomining\",\n \"Suspicious AWS EC2 Activities\"\n ],\n \"detections\": [\n \"Abnormally High AWS Instances Launched by User - MLTK\"\n ]\n }\n },\n {\n \"name\": \"Baseline of Excessive AWS Instances Terminated by User - MLTK\",\n \"id\": \"b28ed6de-e4ba-40f7-ae0a-93a088c774ab\",\n \"version\": 1,\n \"date\": \"2019-11-14\",\n \"description\": \"This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\\\\\\nIn addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\\\\\\nMore information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.\",\n \"author\": \"Jason Brewer, Splunk\",\n \"search\": \"`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_terminated by _time src_user | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1\",\n \"tags\": {\n \"analytics_story\": [\n \"Suspicious AWS EC2 Activities\"\n ],\n \"detections\": [\n \"Abnormally High AWS Instances Terminated by User - MLTK\"\n ]\n }\n },\n {\n \"name\": \"Baseline of Network ACL Activity by ARN\",\n \"id\": \"fc0edd96-ff2b-4810-9f1f-63da3783fd63\",\n \"version\": 1,\n \"date\": \"2018-05-21\",\n \"description\": \"This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS Network ACL Activity\"\n ],\n \"detections\": [\n \"Detect Spike in Network ACL Activity\"\n ]\n }\n },\n {\n \"name\": \"Baseline of S3 Bucket deletion activity by ARN\",\n \"id\": \"fc0edd96-ff2b-48b0-9f1f-63eq3783fd63\",\n \"version\": 1,\n \"date\": \"2018-07-17\",\n \"description\": \"This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"Suspicious AWS S3 Activities\"\n ],\n \"detections\": [\n \"Detect Spike in S3 Bucket deletion\"\n ]\n }\n },\n {\n \"name\": \"Baseline of Security Group Activity by ARN\",\n \"id\": \"fc0edd96-ff2b-48b0-9f1f-63da3783fd63\",\n \"version\": 1,\n \"date\": \"2018-04-17\",\n \"description\": \"This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS User Monitoring\"\n ],\n \"detections\": [\n \"Detect Spike in Security Group Activity\"\n ]\n }\n },\n {\n \"name\": \"Baseline of SMB Traffic - MLTK\",\n \"id\": \"df98763b-0b08-4281-8ef9-08db7ac572a9\",\n \"version\": 1,\n \"date\": \"2019-05-08\",\n \"description\": \"This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.\",\n \"how_to_implement\": \"You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding \\\"src\\\" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.\",\n \"author\": \"Rico Valdez, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, \\\"%H\\\") | eval DayOfWeek=strftime(_time, \\\"%A\\\") | `drop_dm_object_name(\\\"All_Traffic\\\")` | fit DensityFunction count by \\\"HourOfDay,DayOfWeek\\\" into smb_pdfmodel\",\n \"tags\": {\n \"analytics_story\": [\n \"DHS Report TA18-074A\",\n \"Disabling Security Tools\",\n \"Emotet Malware DHS Report TA18-201A \",\n \"Hidden Cobra Malware\",\n \"Netsh Abuse\",\n \"Ransomware\"\n ],\n \"detections\": [\n \"Processes launching netsh\",\n \"SMB Traffic Spike - MLTK\"\n ]\n }\n },\n {\n \"name\": \"Count of assets by category\",\n \"id\": \"dcfd6b40-42f9-469d-a433-2e53f7489ff9\",\n \"version\": 1,\n \"date\": \"2017-09-13\",\n \"description\": \"This search shows you every asset category you have and the assets that belong to those categories.\",\n \"how_to_implement\": \"To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"| from datamodel Identity_Management.All_Assets | stats count values(nt_host) by category | sort -count\",\n \"tags\": {\n \"analytics_story\": [\n \"Asset Tracking\"\n ],\n \"detections\": [\n \"Detect Unauthorized Assets by MAC address\"\n ]\n }\n },\n {\n \"name\": \"Count of Unique IPs Connecting to Ports\",\n \"id\": \"9f3bae5a-9fe3-49df-8c84-5edc51d84b7f\",\n \"version\": 1,\n \"date\": \"2017-09-13\",\n \"description\": \"The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them.\",\n \"how_to_implement\": \"To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model.\",\n \"author\": \"David Dorsey, Splunk\",\n \"search\": \"| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name(\\\"All_Traffic\\\")` | sort - count\",\n \"tags\": {}\n },\n {\n \"name\": \"Create a list of approved AWS service accounts\",\n \"id\": \"fc0edc95-ff2b-48b1-5f6f-63ga3789fd43\",\n \"version\": 2,\n \"date\": \"2018-12-03\",\n \"description\": \"This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file.\",\n \"how_to_implement\": \"You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate.\",\n \"author\": \"Bhavin Patel, Splunk\",\n \"search\": \"`cloudtrail` errorCode=success | rename userName as identity | search NOT [inputlookup identity_lookup_expanded | fields identity] | stats count by identity | table identity | outputlookup aws_service_accounts | stats count\",\n \"tags\": {\n \"analytics_story\": [\n \"AWS User Monitoring\"\n ],\n \"detections\": [\n \"Detect AWS API Activities From Unapproved Accounts\"\n ]\n }\n },\n {\n \"name\": \"Discover DNS records\",\n \"id\": \"c096f721-8842-42ce-bfc7-74bd8c72b7c3\",\n \"version\": 1,\n \"date\": \"2019-02-14\",\n \"description\": \"The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup\",\n \"how_to_implement\": \"To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation\",\n \"author\": \"Jose Hernandez, Splunk\",\n \"search\": \"| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, \\\"\\\\*\\\", \\\"\\\")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\\\"unknown\\\" DNS.answer!=\\\"\\\" by DNS.query | rename DNS.query as query | where query!=\\\"unknown\\\" | rex field=query \\\"(?baselines endpoint
\n","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"66ed8f1c-812e-464c-917d-fc66a550f6f6"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"cb3567b0-816b-4fc7-a9c2-8b0e5b01766f"}}],"_postman_id":"1f4a0afd-ffdc-4d7e-8031-091ed4abe8f5"},{"name":"macros","item":[{"name":"/macros","id":"ca2c1881-1145-47b5-946f-9e3f5d8610fa","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"GET","header":[],"url":"https://content.splunkresearch.com/macros","description":"list all macros
\n","urlObject":{"path":["macros"],"host":["https://content.splunkresearch.com"],"query":[],"variable":[]}},"response":[{"id":"c03a8ad5-f804-48a7-9ba0-2ca3583aac31","name":"/macros","originalRequest":{"method":"GET","header":[],"url":"https://content.splunkresearch.com/macros"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Date","value":"Thu, 05 Nov 2020 08:27:23 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Content-Length","value":"20557"},{"key":"Connection","value":"keep-alive"},{"key":"x-amzn-RequestId","value":"1584386b-d4bc-4f5d-9b66-3b6fe246d1a1"},{"key":"Access-Control-Allow-Origin","value":"*"},{"key":"Access-Control-Allow-Headers","value":"Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key"},{"key":"x-amz-apigw-id","value":"VhmYjGjHvHcFQ8w="},{"key":"X-Amzn-Trace-Id","value":"Root=1-5fa3b769-2407effa3d9cb3b77fe5885b;Sampled=0"}],"cookie":[],"responseTime":null,"body":"{\n \"macros\": [\n {\n \"definition\": \"sourcetype=\\\"aws:cloudwatchlogs:eks\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"aws_cloudwatchlogs_eks\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"aws_cross_account_activity_from_previously_unseen_account___dm_filter\"\n },\n {\n \"definition\": \"sourcetype=aws:s3:accesslogs\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"aws_s3_accesslogs\"\n },\n {\n \"definition\": \"sourcetype=\\\"aws:securityhub:firehose\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"aws_securityhub_firehose\"\n },\n {\n \"definition\": \"lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true\",\n \"description\": \"This macro limits the output to only domains that are in the brand monitoring lookup file\",\n \"name\": \"brand_abuse_dns\"\n },\n {\n \"definition\": \"lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true\",\n \"description\": \"This macro limits the output to only domains that are in the brand monitoring lookup file\",\n \"name\": \"brand_abuse_email\"\n },\n {\n \"definition\": \"lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true\",\n \"description\": \"This macro limits the output to only domains that are in the brand monitoring lookup file\",\n \"name\": \"brand_abuse_web\"\n },\n {\n \"definition\": \"eventtype=cisco_ios\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cisco_networks\"\n },\n {\n \"description\": \"Use this macro to add additional filters for monitoring clients connecting to multiple dns servers\",\n \"name\": \"clients_connecting_to_multiple_dns_servers_output_filter\",\n \"definition\": \"search *\"\n },\n {\n \"definition\": \"sourcetype=aws:cloudtrail\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudtrail\"\n },\n {\n \"definition\": \"sourcetype=\\\"aws:cloudwatchlogs:eks\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch eks logs. Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudwatch_eks\"\n },\n {\n \"definition\": \"sourcetype=aws:cloudwatchlogs:vpcflow\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudwatch_vpc\"\n },\n {\n \"definition\": \"sourcetype=aws:cloudwatchlogs:vpcflow\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"cloudwatchlogs_vpcflow\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filter for create or delete windows shares\",\n \"name\": \"create_or_delete_windows_shares_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters to prevent i.e. false positives\",\n \"name\": \"detect_arp_poisoning_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"detect_new_user_aws_console_login___dm_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters to prevent i.e. false positives\",\n \"name\": \"detect_rogue_dhcp_server_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"detect_zerologon_via_zeek_filter\"\n },\n {\n \"definition\": \"lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True\",\n \"description\": \"This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.\",\n \"name\": \"dynamic_dns_providers\"\n },\n {\n \"definition\": \"lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True\",\n \"description\": \"This is a description\",\n \"name\": \"dynamic_dns_web_traffic\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"ec2_excessive_runinstances_mltk_input_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"ec2_excessive_terminateinstances_mltk_input_filter\"\n },\n {\n \"definition\": \"(eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=GetConsoleOutput OR eventName=GetConsoleScreenshot OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)\",\n \"description\": \"This is a list of AWS event names that have to do with modifying Amazon EC2 instances\",\n \"name\": \"ec2_modification_api_calls\"\n },\n {\n \"definition\": \"(query=login* AND query=www*)\",\n \"description\": \"This limits the query fields to domains that are associated with evilginx masquerading as Office 365\",\n \"name\": \"evilginx_phishlets_0365\"\n },\n {\n \"definition\": \"(query=fls-na* AND query = www* AND query=images*)\",\n \"description\": \"This limits the query fields to domains that are associated with evilginx masquerading as Amazon\",\n \"name\": \"evilginx_phishlets_amazon\"\n },\n {\n \"definition\": \"(query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)\",\n \"description\": \"This limits the query fields to domains that are associated with evilginx masquerading as an AWS console\",\n \"name\": \"evilginx_phishlets_aws\"\n },\n {\n \"definition\": \"(query=www* AND query = m* AND query=static*)\",\n \"description\": \"This limits the query fields to domains that are associated with evilginx masquerading as FaceBook\",\n \"name\": \"evilginx_phishlets_facebook\"\n },\n {\n \"definition\": \"(query=api* AND query = github*)\",\n \"description\": \"This limits the query fields to domains that are associated with evilginx masquerading as GitHub\",\n \"name\": \"evilginx_phishlets_github\"\n },\n {\n \"definition\": \"(query=accounts* AND query=ssl* AND query=www*)\",\n \"description\": \"This limits the query fields to domains that are associated with evilginx masquerading as Google\",\n \"name\": \"evilginx_phishlets_google\"\n },\n {\n \"definition\": \"(query=outlook* AND query=login* AND query=account*)\",\n \"description\": \"This limits the query fields to domains that are associated with evilginx masquerading as Outlook\",\n \"name\": \"evilginx_phishlets_outlook\"\n },\n {\n \"definition\": \"index=netops sourcetype=\\\"f5:bigip:rogue\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"f5_bigip_rogue\"\n },\n {\n \"definition\": \"lookup update=true lookup_rare_process_whitelist_default process as process OUTPUTNEW whitelist | where whitelist=\\\"false\\\" | lookup update=true lookup_rare_process_whitelist_local process as process OUTPUT whitelist | where whitelist=\\\"false\\\"\",\n \"description\": \"This macro is intended to whitelist processes that have been definied as rare\",\n \"name\": \"filter_rare_process_whitelist\"\n },\n {\n \"definition\": \"sourcetype=\\\"google:gcp:pubsub:message\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype) for Google GCP. Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"google_gcp_pubnet_message\"\n },\n {\n \"definition\": \"sourcetype=\\\"google:gcp:pubsub:message\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"google_gcp_pubsub_message\"\n },\n {\n \"definition\": \"lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true\",\n \"description\": \"This macro limits the output to process names that are in the Windows System directory\",\n \"name\": \"is_windows_system_file\"\n },\n {\n \"definition\": \"sourcetype=mscs:storage:blob:json\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"kubernetes_azure\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"kubernetes_azure_detect_rbac_authorization_by_account_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"kubernetes_azure_detect_sensitive_object_access_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"kubernetes_azure_detect_sensitive_role_access_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"kubernetes_azure_detect_suspicious_kubectl_calls_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"kubernetes_azure_pod_scan_fingerprint_detection_filter\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"kubernetes_azure_scan_fingerprint_filter\"\n },\n {\n \"definition\": \"sourcetype=\\\"netbackup_logs\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"netbackup\"\n },\n {\n \"definition\": \"(eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)\",\n \"description\": \"This is a list of AWS event names that are associated with Network ACLs\",\n \"name\": \"network_acl_events\"\n },\n {\n \"definition\": \"eventtype=okta_log\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"okta\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"previously_seen_cloud_compute_creations_by_user_input_filter\"\n },\n {\n \"description\": \"Use this macro to determine how far into the past the window should be to determine if the user is new or not\",\n \"definition\": \"-70m@m\",\n \"name\": \"previously_seen_cloud_compute_creations_by_user_search_window_begin_offset\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"previously_seen_cloud_compute_image_input_filter\"\n },\n {\n \"description\": \"Use this macro to determine how far into the past the window should be to determine if the image is new or not\",\n \"definition\": \"-70m@m\",\n \"name\": \"previously_seen_cloud_compute_image_search_window_begin_offset\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"previously_seen_cloud_compute_instance_types_input_filter\"\n },\n {\n \"description\": \"Use this macro to determine how far into the past the window should be to determine if the instance type is new or not\",\n \"definition\": \"-70m@m\",\n \"name\": \"previously_seen_cloud_compute_instance_types_search_window_begin_offset\"\n },\n {\n \"definition\": \"search *\",\n \"description\": \"Use this macro to add additional filters\",\n \"name\": \"previously_seen_cloud_regions_input_filter\"\n },\n {\n \"description\": \"Use this macro to determine how far into the past the window should be to determine if the region is new or not\",\n \"definition\": \"-70m@m\",\n \"name\": \"previously_seen_cloud_regions_search_window_begin_offset\"\n },\n {\n \"description\": \"Use this macro to determine how long to keep track of Windows services\",\n \"definition\": \"-90d@d\",\n \"name\": \"previously_seen_windows_services_forget_window\"\n },\n {\n \"description\": \"Use this macro to determine how far back you should be checking for new Windows services\",\n \"definition\": \"-70m@m\",\n \"name\": \"previously_seen_windows_service_window\"\n },\n {\n \"description\": \"Use this macro to determine how long to keep track of zoom child processes\",\n \"definition\": \"-90d@d\",\n \"name\": \"previously_seen_zoom_child_processes_forget_window\"\n },\n {\n \"description\": \"Use this macro to determine how far back you should be checking for new zoom child processes\",\n \"definition\": \"-70m@m\",\n \"name\": \"previously_seen_zoom_child_processes_window\"\n },\n {\n \"definition\": \"| inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name=\\\"*\\\" . parent_process_name | table parent_process_name\",\n \"description\": \"This macro outputs a list of process that should not be the parent process of cmd.exe\",\n \"name\": \"prohibited_apps_launching_cmd\"\n },\n {\n \"definition\": \"lookup interesting_processes_lookup app as process_name OUTPUT is_prohibited | search is_prohibited=True\",\n \"description\": \"This macro limits the output to process_names that have been marked as prohibited\",\n \"name\": \"prohibited_softwares\"\n },\n {\n \"definition\": \"lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False\",\n \"description\": \"This macro limits the output to files that have extensions associated with ransomware\",\n \"name\": \"ransomware_extensions\"\n },\n {\n \"definition\": \"lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as \\\"Known Ransomware Notes\\\" | search \\\"Known Ransomware Notes\\\"=True\",\n \"description\": \"This macro limits the output to files that have been identified as a ransomware note\",\n \"name\": \"ransomware_notes\"\n },\n {\n \"definition\": \"eval domain=trim(domain,\\\"*\\\") | search NOT[| inputlookup domains] NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain=\\\"*\\\"+domain+\\\"*\\\"\",\n \"description\": \"This macro removes valid domains from the output\",\n \"name\": \"remove_valid_domains\"\n },\n {\n \"definition\": \"sourcetype=aws:s3:accesslogs\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"s3_accesslogs\"\n },\n {\n \"arguments\": [\n \"field\"\n ],\n \"definition\": \"convert timeformat=\\\"%Y-%m-%dT%H:%M:%S\\\" ctime($field$)\",\n \"description\": \"convert epoch time to string\",\n \"name\": \"security_content_ctime\"\n },\n {\n \"definition\": \"summariesonly=false allow_old_summaries=true\",\n \"description\": \"search data model's summaries only\",\n \"name\": \"security_content_summariesonly\"\n },\n {\n \"definition\": \"(eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)\",\n \"description\": \"This macro is a list of AWS event names associated with security groups\",\n \"name\": \"security_group_api_calls\"\n },\n {\n \"definition\": \"sourcetype=stream:dns\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"stream_dns\"\n },\n {\n \"definition\": \"sourcetype=stream:http\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"stream_http\"\n },\n {\n \"definition\": \"sourcetype=stream:tcp\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"stream_tcp\"\n },\n {\n \"definition\": \"lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true\",\n \"description\": \"This macro limits the output to email attachments that have suspicious extensions\",\n \"name\": \"suspicious_email_attachments\"\n },\n {\n \"definition\": \"lookup suspicious_writes_lookup file as file_name OUTPUT note as \\\"Reference\\\" | search \\\"Reference\\\" != False\",\n \"description\": \"This macro limites the output to file names that have been marked as suspicious\",\n \"name\": \"suspicious_writes\"\n },\n {\n \"definition\": \"sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"sysmon\"\n },\n {\n \"definition\": \"(process_name= \\\"arp.exe\\\" OR process_name= \\\"at.exe\\\" OR process_name= \\\"attrib.exe\\\" OR process_name= \\\"cscript.exe\\\" OR process_name= \\\"dsquery.exe\\\" OR process_name= \\\"hostname.exe\\\" OR process_name= \\\"ipconfig.exe\\\" OR process_name= \\\"mimikatz.exe\\\" OR process_name= \\\"nbstat.exe\\\" OR process_name= \\\"net.exe\\\" OR process_name= \\\"netsh.exe\\\" OR process_name= \\\"nslookup.exe\\\" OR process_name= \\\"ping.exe\\\" OR process_name= \\\"quser.exe\\\" OR process_name= \\\"qwinsta.exe\\\" OR process_name= \\\"reg.exe\\\" OR process_name= \\\"runas.exe\\\" OR process_name= \\\"sc.exe\\\" OR process_name= \\\"schtasks.exe\\\" OR process_name= \\\"ssh.exe\\\" OR process_name= \\\"systeminfo.exe\\\" OR process_name= \\\"taskkill.exe\\\" OR process_name= \\\"telnet.exe\\\" OR process_name= \\\"tracert.exe\\\" OR process_name=\\\"wscript.exe\\\" OR process_name= \\\"xcopy.exe\\\")\",\n \"description\": \"This macro is a list of process that can be used to discover the network configuration\",\n \"name\": \"system_network_configuration_discovery_tools\"\n },\n {\n \"definition\": \"lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true\",\n \"description\": \"This macro limits the output to processes that have been marked as uncommon\",\n \"name\": \"uncommon_processes\"\n },\n {\n \"definition\": \"eventtype=wineventlog_security\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"wineventlog_security\"\n },\n {\n \"definition\": \"eventtype=wineventlog_system\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"wineventlog_system\"\n },\n {\n \"definition\": \"sourcetype=\\\"wineventlog:microsoft-windows-wmi-activity/operational\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"wmi\"\n },\n {\n \"definition\": \"index=zeek sourcetype=\\\"zeek:rpc:json\\\"\",\n \"description\": \"customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.\",\n \"name\": \"zeek_rpc\"\n }\n ],\n \"count\": 80\n}"}],"_postman_id":"ca2c1881-1145-47b5-946f-9e3f5d8610fa"}],"id":"5180aca7-4e4c-4485-9411-d4934dd3d0a8","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"52fd36e5-26cb-482f-96c5-78a79eda62a4"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"f67e0133-718b-4151-8651-23b3149076ae"}}],"_postman_id":"5180aca7-4e4c-4485-9411-d4934dd3d0a8","description":""},{"name":"lookups","item":[{"name":"/lookups","id":"8e083f7f-1cd6-4a8d-9b60-230adbd84fed","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"GET","header":[],"url":"https://content.splunkresearch.com/lookups","description":"list all lookups
\n","urlObject":{"path":["lookups"],"host":["https://content.splunkresearch.com"],"query":[],"variable":[]}},"response":[{"id":"074b6fa3-2124-4b25-93e1-a36d7a0d12f8","name":"/lookups","originalRequest":{"method":"GET","header":[],"url":"https://content.splunkresearch.com/lookups"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Date","value":"Thu, 05 Nov 2020 08:28:04 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Content-Length","value":"10560"},{"key":"Connection","value":"keep-alive"},{"key":"x-amzn-RequestId","value":"6de95a52-4ad5-4aea-9c6c-22db237236e6"},{"key":"Access-Control-Allow-Origin","value":"*"},{"key":"Access-Control-Allow-Headers","value":"Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key"},{"key":"x-amz-apigw-id","value":"VhmeoENwvHcFVqw="},{"key":"X-Amzn-Trace-Id","value":"Root=1-5fa3b790-5c43d84a781f87a4464c6eff;Sampled=0"}],"cookie":[],"responseTime":null,"body":"{\n \"lookups\": [\n {\n \"description\": \"A collection that will contain the baseline information for number of AWS API calls per user\",\n \"collection\": \"api_call_by_user_baseline\",\n \"name\": \"api_call_by_user_baseline\",\n \"fields_list\": \"arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/api_call_by_user_baseline.csv\"\n },\n {\n \"description\": \"A lookup file that will contain AWS Service accounts\",\n \"filename\": \"aws_service_accounts.csv\",\n \"name\": \"aws_service_accounts\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/aws_service_accounts.csv\"\n },\n {\n \"description\": \"A lookup file that will contain the baseline information for number of blocked outbound connections\",\n \"filename\": \"baseline_blocked_outbound_connections.csv\",\n \"name\": \"baseline_blocked_outbound_connections\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/baseline_blocked_outbound_connections.csv\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A file that contains look-a-like domains for brands that you want to monitor\",\n \"filename\": \"brand_monitoring.csv\",\n \"match_type\": \"WILDCARD(domain)\",\n \"min_matches\": 1,\n \"name\": \"brandMonitoring_lookup\"\n },\n {\n \"description\": \"The CSC control numbers and names\",\n \"filename\": \"csc_lookup.csv\",\n \"min_matches\": 1,\n \"name\": \"csc_lookup\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/csc_lookup.csv\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records\",\n \"filename\": \"discovered_dns_records.csv\",\n \"min_matches\": 1,\n \"name\": \"discovered_dns_records\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/discovered_dns_records.csv\"\n },\n {\n \"description\": \"A list of domains that can be whitelisted\",\n \"filename\": \"domains.csv\",\n \"name\": \"domains\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/domains.csv\"\n },\n {\n \"case_sensitive_match\": \"false\",\n \"description\": \"A list of dynammic dns providers that should not be modified\",\n \"filename\": \"dynamic_dns_providers_default.csv\",\n \"match_type\": \"WILDCARD(dynamic_dns_domains)\",\n \"name\": \"dynamic_dns_providers_default\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/dynamic_dns_providers_default.csv\"\n },\n {\n \"case_sensitive_match\": \"false\",\n \"description\": \"A list of dynammic dns providers that can be modified\",\n \"filename\": \"dynamic_dns_providers_local.csv\",\n \"match_type\": \"WILDCARD(dynamic_dns_domains)\",\n \"name\": \"dynamic_dns_providers_local\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/dynamic_dns_providers_local.csv\"\n },\n {\n \"description\": \"A placeholder lookup file to hold information for ESCU Usage dashboard\",\n \"filename\": \"escu_search_id.csv\",\n \"name\": \"escu_search_id_lookup\"\n },\n {\n \"description\": \"A list of suspicious extensions for email attachments\",\n \"filename\": \"is_suspicious_file_extension_lookup.csv\",\n \"match_type\": \"WILDCARD(file_name)\",\n \"name\": \"is_suspicious_file_extension_lookup\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/is_suspicious_file_extension_lookup.csv\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A list of executable files in Windows\\\\System32\",\n \"filename\": \"is_windows_system_file.csv\",\n \"min_matches\": 1,\n \"name\": \"is_windows_system_file\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/is_windows_system_file.csv\"\n },\n {\n \"description\": \"A list of legit domains to be used to whitelist possible phishing sites\",\n \"filename\": \"legit_domains.csv\",\n \"name\": \"legit_domains\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/legit_domains.csv\"\n },\n {\n \"case_sensitive_match\": \"false\",\n \"default_match\": \"false\",\n \"description\": \"A list of rare processes that are legitimate provided by Splunk\",\n \"filename\": \"rare_process_whitelist_default.csv\",\n \"match_type\": \"WILDCARD(process)\",\n \"min_matches\": 1,\n \"name\": \"lookup_rare_process_whitelist_default\"\n },\n {\n \"case_sensitive_match\": \"false\",\n \"default_match\": \"false\",\n \"description\": \"A list of rare processes that are legitimate provided by the end user\",\n \"filename\": \"rare_process_whitelist_local.csv\",\n \"match_type\": \"WILDCARD(process)\",\n \"min_matches\": 1,\n \"name\": \"lookup_rare_process_whitelist_local\"\n },\n {\n \"case_sensitive_match\": \"false\",\n \"description\": \"A list of processes that are not common\",\n \"filename\": \"uncommon_processes_default.csv\",\n \"match_type\": \"WILDCARD(process)\",\n \"name\": \"lookup_uncommon_processes_default\"\n },\n {\n \"case_sensitive_match\": \"false\",\n \"description\": \"A list of processes that are not common\",\n \"filename\": \"uncommon_processes_local.csv\",\n \"match_type\": \"WILDCARD(process)\",\n \"name\": \"lookup_uncommon_processes_local\"\n },\n {\n \"description\": \"A lookup file that will contain the baseline information for number of AWS Network ACL Activity\",\n \"filename\": \"network_acl_activity_baseline.csv\",\n \"name\": \"network_acl_activity_baseline\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/network_acl_activity_baseline.csv\"\n },\n {\n \"description\": \"A placeholder for a list of IPs that have access S3\",\n \"filename\": \"previously_seen_S3_access_from_remote_ip.csv\",\n \"name\": \"previously_seen_S3_access_from_remote_ip\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_S3_access_from_remote_ip.csv\"\n },\n {\n \"description\": \"A placeholder for a list of AWS API calls for each user role\",\n \"filename\": \"previously_seen_api_calls_from_user_roles.csv\",\n \"name\": \"previously_seen_api_calls_from_user_roles\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_api_calls_from_user_roles.csv\"\n },\n {\n \"description\": \"A placeholder for a list of AWS accounts and assumed roles\",\n \"filename\": \"previously_seen_aws_cross_account_activity.csv\",\n \"name\": \"previously_seen_aws_cross_account_activity\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_aws_cross_account_activity.csv\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A place holder for a list of used AWS regions\",\n \"filename\": \"previously_seen_aws_regions.csv\",\n \"min_matches\": 1,\n \"name\": \"previously_seen_aws_regions\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_aws_regions.csv\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A place holder for a list of users that have created cloud compute instances\",\n \"filename\": \"previously_seen_cloud_compute_creations_by_user.csv\",\n \"min_matches\": 1,\n \"name\": \"previously_seen_cloud_compute_creations_by_user\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_cloud_compute_creations_by_user.csv\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A place holder for a list of used cloud compute images\",\n \"filename\": \"previously_seen_cloud_compute_images.csv\",\n \"min_matches\": 1,\n \"name\": \"previously_seen_cloud_compute_images\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_cloud_compute_images.csv\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A place holder for a list of used cloud compute instance types\",\n \"filename\": \"previously_seen_cloud_compute_instance_types.csv\",\n \"min_matches\": 1,\n \"name\": \"previously_seen_cloud_compute_instance_types\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_cloud_compute_instance_types.csv\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A place holder for a list of used cloud compute images\",\n \"filename\": \"previously_seen_cloud_regions.csv\",\n \"min_matches\": 1,\n \"name\": \"previously_seen_cloud_regions\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_cloud_regions.csv\"\n },\n {\n \"description\": \"A placeholder for a list of cmd line arugments that been seen before\",\n \"filename\": \"previously_seen_cmd_line_arguments.csv\",\n \"name\": \"previously_seen_cmd_line_arguments\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_cmd_line_arguments.csv\"\n },\n {\n \"description\": \"A place holder for a list of AWS EC2 modifications done by each user\",\n \"filename\": \"previously_seen_ec2_modifications_by_user.csv\",\n \"name\": \"previously_seen_ec2_modifications_by_user\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_ec2_modifications_by_user.csv\"\n },\n {\n \"description\": \"A placeholder for the list of Windows Services running\",\n \"collection\": \"previously_seen_running_windows_services\",\n \"name\": \"previously_seen_running_windows_services\",\n \"fields_list\": \"_key, service, firstTimeSeen, lastTimeSeen\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/previously_seen_running_windows_services.csv\"\n },\n {\n \"description\": \"A list of processes that have been marked as prohibited\",\n \"filename\": \"prohibited_processes.csv\",\n \"name\": \"prohibitedProcesses_lookup\"\n },\n {\n \"description\": \"A list of processes that should not be launching cmd.exe\",\n \"fields\": \"prohibited_applications\",\n \"filename\": \"prohibited_apps_launching_cmd.csv\",\n \"match_type\": \"WILDCARD(prohibited_applications)\",\n \"name\": \"prohibited_apps_launching_cmd\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/prohibited_apps_launching_cmd.csv\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A list of file extensions that are associated with ransomware\",\n \"filename\": \"ransomware_extensions.csv\",\n \"min_matches\": 1,\n \"name\": \"ransomware_extensions_lookup\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A list of file names that are ransomware note files\",\n \"filename\": \"ransomware_notes.csv\",\n \"match_type\": \"WILDCARD(ransomware_notes)\",\n \"min_matches\": 1,\n \"name\": \"ransomware_notes_lookup\"\n },\n {\n \"description\": \"A placeholder for the baseline information for AWS S3 deletions\",\n \"filename\": \"s3_deletion_baseline.csv\",\n \"name\": \"s3_deletion_baseline\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/s3_deletion_baseline.csv\"\n },\n {\n \"description\": \"A placeholder for the baseline information for AWS security groups\",\n \"filename\": \"security_group_activity_baseline.csv\",\n \"name\": \"security_group_activity_baseline\",\n \"csv_file_url\": \"https://security-content.s3-us-west-2.amazonaws.com/lookups/security_group_activity_baseline.csv\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A list of services that deal with security\",\n \"filename\": \"security_services.csv\",\n \"match_type\": \"WILDCARD(service)\",\n \"min_matches\": 1,\n \"name\": \"security_services_lookup\"\n },\n {\n \"default_match\": \"false\",\n \"description\": \"A list of suspicious file names\",\n \"filename\": \"suspicious_files.csv\",\n \"match_type\": \"WILDCARD(file)\",\n \"min_matches\": 1,\n \"name\": \"suspicious_writes_lookup\"\n },\n {\n \"description\": \"A list of suspicious file names\",\n \"collection\": \"zoom_first_time_child_process\",\n \"name\": \"zoom_first_time_child_process\",\n \"fields_list\": \"_key, dest, process_name, firstTimeSeen, lastTimeSeen\"\n }\n ],\n \"count\": 38\n}"}],"_postman_id":"8e083f7f-1cd6-4a8d-9b60-230adbd84fed"}],"id":"4a4764a0-e9e1-476e-a6ae-1d5c262d77f5","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"5d2ba0ba-b9cc-4c74-9a5d-fef26056e83f"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"1f750d56-5f20-47ef-b34f-3e646fb88572"}}],"_postman_id":"4a4764a0-e9e1-476e-a6ae-1d5c262d77f5","description":""},{"name":"deployments","item":[{"name":"/deployments","id":"86a7b75c-33c5-43cf-8e00-1f38299025ef","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"GET","header":[],"url":"https://content.splunkresearch.com/deployments","description":"list all deployments
\n","urlObject":{"path":["deployments"],"host":["https://content.splunkresearch.com"],"query":[],"variable":[]}},"response":[{"id":"1c409274-7645-4325-80cb-2ebd999703db","name":"/deployments","originalRequest":{"method":"GET","header":[],"url":"https://content.splunkresearch.com/deployments"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Date","value":"Thu, 05 Nov 2020 08:28:52 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Content-Length","value":"3260"},{"key":"Connection","value":"keep-alive"},{"key":"x-amzn-RequestId","value":"201c5fe6-fbe8-4f0e-886c-e685a63a657b"},{"key":"Access-Control-Allow-Origin","value":"*"},{"key":"Access-Control-Allow-Headers","value":"Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key"},{"key":"x-amz-apigw-id","value":"VhmmqHayPHcFY3g="},{"key":"X-Amzn-Trace-Id","value":"Root=1-5fa3b7c4-7e560e870ebc4a4d46f8fc88;Sampled=0"}],"cookie":[],"responseTime":null,"body":"{\n \"deployments\": [\n {\n \"name\": \"Enterprise Security deployment configuration\",\n \"id\": \"bc91a8cd-35e7-4bb2-6140-e756cc46f212\",\n \"date\": \"2020-04-27\",\n \"description\": \"This configuration file applies to all correlation searches that are used for detection\",\n \"author\": \"Bhavin Patel\",\n \"scheduling\": {\n \"cron_schedule\": \"0 * * * *\",\n \"earliest_time\": \"-70m@m\",\n \"latest_time\": \"-10m@m\",\n \"schedule_window\": \"auto\"\n },\n \"alert_action\": {\n \"notable\": {\n \"rule_description\": \"%description%\",\n \"rule_title\": \"%name%\",\n \"nes_fields\": [\n \"user\",\n \"dest\",\n \"src\"\n ]\n }\n },\n \"tags\": {\n \"analytics_story\": \"all\"\n }\n },\n {\n \"name\": \"Detect ARP Poisoning deployment configuration\",\n \"id\": \"e1d5b4dc-4cf3-404f-905c-b478bbb20474\",\n \"date\": \"2020-08-14\",\n \"description\": \"This configuration file applies to the Detect ARP Poisoning detection\",\n \"author\": \"Mikael Bjerkeland\",\n \"scheduling\": {\n \"cron_schedule\": \"59 * * * *\",\n \"earliest_time\": \"-70m@m\",\n \"latest_time\": \"-10m@m\",\n \"schedule_window\": \"auto\"\n },\n \"alert_action\": {\n \"notable\": {\n \"rule_description\": \"ARP Poisoning has been detected on interface $src_interface$ on host $orig_host$. This may be an indication of a MITM attack.\",\n \"rule_title\": \"ARP Poisoning Detected on $orig_host$\",\n \"nes_fields\": [\n \"src_interface\",\n \"firstTime\",\n \"lastTime\",\n \"count\"\n ]\n }\n },\n \"tags\": {\n \"detection_name\": \"Detect ARP Poisoning\"\n }\n },\n {\n \"name\": \"Detect Rogue DHCP Server deployment configuration\",\n \"id\": \"6e4e20ac-e719-4ebe-a52d-d672cd451dbb\",\n \"date\": \"2020-08-14\",\n \"description\": \"This configuration file applies to the Detect Rogue DHCP Server detection\",\n \"author\": \"Mikael Bjerkeland\",\n \"scheduling\": {\n \"cron_schedule\": \"59 * * * *\",\n \"earliest_time\": \"-70m@m\",\n \"latest_time\": \"-10m@m\",\n \"schedule_window\": \"auto\"\n },\n \"alert_action\": {\n \"notable\": {\n \"rule_description\": \"DHCP Snooping has detected a Rogue DHCP Server on $orig_host$ from $src_mac$. This may be an indication of a MITM attack.\",\n \"rule_title\": \"Rogue DHCP Server Detected on $orig_host$\",\n \"nes_fields\": [\n \"src_mac\",\n \"firstTime\",\n \"lastTime\",\n \"count\",\n \"message_type\"\n ]\n }\n },\n \"tags\": {\n \"detection_name\": \"Detect Rogue DHCP Server\"\n }\n },\n {\n \"name\": \"Baseline Cache Hourly Updates\",\n \"id\": \"1030c701-2acf-4b1a-9970-46c7145caf2d\",\n \"date\": \"2020-06-24\",\n \"description\": \"This configuration file applies to all baselines with tag deployments Hourly Cache Updates\",\n \"author\": \"Bhavin Patel\",\n \"scheduling\": {\n \"cron_schedule\": \"55 * * * *\",\n \"earliest_time\": \"-70m@m\",\n \"latest_time\": \"-10m@m\",\n \"schedule_window\": \"auto\"\n },\n \"tags\": {\n \"deployments\": [\n \"Hourly Cache Updates\"\n ]\n }\n },\n {\n \"name\": \"90 Day Baseline Searches\",\n \"id\": \"6eac9f8b-a35d-4b64-b57f-e5ecde43be6b\",\n \"date\": \"2020-06-24\",\n \"description\": \"This configuration file applies to all baselines with tag deployments Long Running Baseline\",\n \"author\": \"Bhavin Patel\",\n \"scheduling\": {\n \"cron_schedule\": \"0 4 * * *\",\n \"earliest_time\": \"-90d@d\",\n \"latest_time\": \"-10m@m\",\n \"schedule_window\": \"auto\"\n },\n \"tags\": {\n \"deployments\": [\n \"90 Day Baseline\"\n ]\n }\n },\n {\n \"name\": \"Enterprise Security deployment configuration\",\n \"id\": \"bc91a8cd-35e7-4bb2-6140-e756cc46f212\",\n \"date\": \"2020-04-27\",\n \"description\": \"This configuration file applies to all correlation searches that are used for detection\",\n \"author\": \"Bhavin Patel\",\n \"scheduling\": {\n \"cron_schedule\": \"*/30 * * * *\",\n \"earliest_time\": \"-30m\",\n \"latest_time\": \"now\",\n \"schedule_window\": \"auto\"\n },\n \"alert_action\": {\n \"notable\": {\n \"rule_description\": \"%description%\",\n \"rule_title\": \"%name%\",\n \"nes_fields\": [\n \"user\",\n \"dest\",\n \"src\"\n ]\n }\n },\n \"tags\": {\n \"analytics_story\": \"all\"\n }\n }\n ],\n \"count\": 6\n}"}],"_postman_id":"86a7b75c-33c5-43cf-8e00-1f38299025ef"}],"id":"b99c623b-1414-47a4-8604-d441bed89880","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"61222723-4be4-485d-b040-2f3ea76dbc55"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"a1028564-11eb-4ee7-b6ec-da0efd07a10d"}}],"_postman_id":"b99c623b-1414-47a4-8604-d441bed89880","description":""},{"name":"/","id":"23e8bf3b-c270-4583-b903-6876c80bd17d","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"GET","header":[],"url":"https://content.splunkresearch.com/","description":"Welcome page
\n","urlObject":{"path":[""],"host":["https://content.splunkresearch.com"],"query":[],"variable":[]}},"response":[{"id":"c937427b-1a11-4bc4-87bf-91c17e8ad57d","name":"/","originalRequest":{"method":"GET","header":[],"url":"https://content.splunkresearch.com/"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Date","value":"Thu, 05 Nov 2020 08:29:18 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Content-Length","value":"60"},{"key":"Connection","value":"keep-alive"},{"key":"x-amzn-RequestId","value":"b0ce98fe-f5a2-42c7-85c6-c18c1d099be2"},{"key":"Access-Control-Allow-Origin","value":"*"},{"key":"Access-Control-Allow-Headers","value":"Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key"},{"key":"x-amz-apigw-id","value":"VhmqyEgLvHcFejg="},{"key":"X-Amzn-Trace-Id","value":"Root=1-5fa3b7de-0568e60e5daf3e6d018682f5;Sampled=0"}],"cookie":[],"responseTime":null,"body":"{\n \"hello\": \"welcome to Splunks Research security content api\"\n}"}],"_postman_id":"23e8bf3b-c270-4583-b903-6876c80bd17d"},{"name":"/version","id":"96fbafee-0b20-4d5e-97b4-2f1afca30682","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"GET","header":[],"url":"https://content.splunkresearch.com/version","description":"Welcome page
\n","urlObject":{"path":["version"],"host":["https://content.splunkresearch.com"],"query":[],"variable":[]}},"response":[{"id":"b3ad4669-182e-41e6-aada-88af8d767775","name":"/version","originalRequest":{"method":"GET","header":[],"url":"https://content.splunkresearch.com/version"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Date","value":"Thu, 05 Nov 2020 08:29:29 GMT"},{"key":"Content-Type","value":"application/json"},{"key":"Content-Length","value":"67"},{"key":"Connection","value":"keep-alive"},{"key":"x-amzn-RequestId","value":"76d4a04c-5efa-49e1-a31c-2e0321301c0b"},{"key":"Access-Control-Allow-Origin","value":"*"},{"key":"Access-Control-Allow-Headers","value":"Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key"},{"key":"x-amz-apigw-id","value":"VhmscFgWPHcFSxw="},{"key":"X-Amzn-Trace-Id","value":"Root=1-5fa3b7e9-20dafb1511f35e7f36b6c6ab;Sampled=0"}],"cookie":[],"responseTime":null,"body":"{\n \"version\": {\n \"name\": \"v3.0.8\",\n \"published_at\": \"2020-10-20T22:29:36Z\"\n }\n}"}],"_postman_id":"96fbafee-0b20-4d5e-97b4-2f1afca30682"}],"event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":[""],"id":"c1e9d3d8-bc24-4364-98cb-02863a310fa2"}},{"listen":"test","script":{"type":"text/javascript","exec":[""],"id":"2b2cc39a-e59e-4e77-a77b-da0c828d68b5"}}],"variable":[{"key":"baseUrl","value":"https://content.splunkresearch.com"}]}